Add NETCONF edit-config remediation rendering (#232)

[jtdub]

Summary

Completes the final scope of #232: remediation output that matches the XML input format.

• WorkflowRemediation.remediation_netconf_xml() (plus standalone formats.hconfig_to_netconf_xml()) renders the remediation between two HConfig.from_xml() trees as a NETCONF edit-config-style payload: negated nodes become nc:operation="delete" elements (namespaced via xmlns:nc), additions use NETCONF's default merge operation, and attribute-level changes raise a clear InvalidConfigError (they have no NETCONF operation encoding).
• Keyed list-entry deletions delete by key leaf (<interface nc:operation="delete"><name>eth1</name></interface>), resolved against the running config; without running-config context the standalone function falls back to value-bearing leaf deletes, which is correct for leaves and leaf-lists.
• Ingestion fix found via this work: the identity suffix was only applied when a tag repeated among siblings, so the same list entry got different node text in configs with different entry counts — producing spurious delete-and-re-add diffs (the exact scenario remediation exists for). Elements are now keyed whenever an identifying list_keys child exists; an identity is only mandatory when the tag actually repeats.

Test plan

• New tests: end-to-end payload structure (delete + merge + namespace declaration), keyed-entry deletion by key leaf, plain-subtree additions, attribute-negation error, no-running-context fallback, and the surgical-diff regression for differing entry counts.
• poetry run ./scripts/build.py lint-and-test — all linters pass, 698 tests, ≥95% coverage.

🤖 Generated with Claude Code