Create a private network (idempotent per name)

Create a private network: a workspace-scoped mesh that nodes join (attach_network, or create_node's network parameter) to reach each other directly over stable private addresses. Private by default in every direction: a node that never attaches keeps exactly today's isolation, members-only membership, no cross-network routing, no internet transit, and nothing on the mesh is ever reachable from the public internet (expose_port stays the only public door). INSIDE a network the posture is one trust zone: every port a member listens on is reachable by every other member - joining a network is trusting its members. Idempotent per name: creating an existing name returns it (created: false), never a duplicate; omitted name = auto-generated. Each member gets a stable IPv4 (from 100.64/10) and IPv6 (ULA) for the node's whole life - across stop/wake, recreate, and repair - plus a DNS name: from inside a member container, <node>.givemeanode.internal (and the short node name, via the search domain) resolves to a peer's stable addresses, and the metadata service's /v1/network returns the full roster in one curl. Outside the containers, peers are reached by the addresses get_node/list_networks show.