Automatically expire stale Pending node entries

[Copilot]

Unsuccessful join attempts can leave Pending node records requiring manual operator cleanup. This adds configurable, primary-driven expiration.

• Expiration

  • Persist each Pending node’s admission timestamp.
  • Periodically remove entries older than pending_node_timeout.
  • Remove associated certificates and sealed recovery data.

• Configuration

  • Default timeout: 24h.
  • Set 0s to disable cleanup.

{
  "pending_node_timeout": "6h"
}

• Compatibility

  • Initialize timestamps for legacy Pending entries on first inspection.
  • Reset invalid or future timestamps to avoid premature deletion.
  • Preserve timestamps across restart and primary failover.

• Integration

  • Add host configuration schema and operator documentation.
  • Add focused unit and end-to-end coverage.

• Fixes Node Pending entries in the KV should automatically expire after a configurable delay #6672