The compiler now projects the global NAT intents through each device's bindings
into the rendered config:
- snat/masquerade: renders on a device that binds the egress zone (and, when the
source is a zone, that zone too), resolving the egress interface — this
auto-scopes masquerade to edge devices. A literal-CIDR source needs only the
egress binding.
- netmap: renders on the device its anchor (device:zone|interface) names,
resolving a zone anchor to its bound interface.
- 1:1 nat: renders on the device it is bound to.
Adds RenderedSNAT/RenderedNetmap/RenderedNAT to the rendered config, fetches the
tiers in Compile, and unit-tests binding-scoping (edge vs interior/other device).
benvin