fix: retain ENIs when orphan cleanup fails

[CMGS]

When Volcengine creates an ENI, a temporary API outage can make both attachment and the bounded compensating delete fail. The unattached ID was then discarded. Subsequent init only discovers attached ENIs, and teardown cannot recover an ID that never reached pool.json.

Return the created ID in the partial result when its compensating delete fails. A failed delete now returns an error before IP allocation, so the existing init failure path persists the owned ID. Successful provisioning also merges previously recorded IDs, preserving that cleanup responsibility across retries. Existing teardown can then delete the detached ENI by ID; this change does not add background collection or promise cleanup during successful init.

The discard-on-compensation-failure path dates to 520516e. #8 added attached-ENI reuse and cancellation cleanup; #12 added persisted-ID teardown; #28 preserved partial attachment results. Those paths still lost an unattached ID when compensation itself failed.

Validation:

• A command-level regression exercises init through the actual Volcengine implementation and a local ve fixture: attach/delete failure, ownership persisted without IP allocation, then successful provisioning retaining previous IDs. The deliberately invalid primary NIC stops before host networking changes.
• Cancellation tests cover successful and failed orphan deletion; teardown tests cover mixed missing/detached IDs and repeated cleanup. The existing create-wait cancellation branch was reviewed in source; no live cloud test was run.
• Negative controls with the original production files fail on the lost ID and on successful-init overwrite, respectively.
• Linux/Darwin lint, formatting, vet and asl pass; make test passes with race detection and coverage on macOS. Missing-ID query behavior was cross-checked against the official provider's ID-filtered read.

Production diff: +4 lines. No DHCP/claim-path change, new cloud call, timer, background worker or persistent format. Only init adds a merge into the existing cleanup ID list.