Bulk model dry runs fail with MODEL_CACHE_MODELSET_MISSING_SIGNATURE #967

On unmodified pfREST 2.10.2, a dry-run replacement of HAProxy frontends containing
one ordinary independent frontend throws:

RESTAPI\Responses\ServerError: ModelSet cannot be cached without a valid signature.

Reproduction on a disposable pfSense CE 2.8.1 installation with HAProxy 0.63_11:

require_once 'RESTAPI/autoloader.inc';
(new \RESTAPI\Models\HAProxyFrontend(dry_run: true))->replace_all([
    ['name' => 'upstream_repro', 'type' => 'http'],
]);

Expected: validate and return the prospective frontend collection without writing
configuration. Actual: MODEL_CACHE_MODELSET_MISSING_SIGNATURE.

Core/Model.inc::replace_all() constructs $new_objects = new ModelSet() without
a signature, then its dry-run branch passes that set to
ModelCache::cache_modelset(), which requires a signature. This is present at
next_minor commit 27e7fd9f28b8f8d25abe594aefa09803a81434a8 as well.

While adding Shared Frontend reference validation, a related ordering problem
became apparent: the first replacement candidate can query the old collection
before the new collection is cached. A shared frontend referencing an existing
primary that is omitted from the replacement must be rejected; it must not
validate using the old primary and only fail later at cache insertion.

Suggested direction for maintainer review: construct the prospective collection
with the model's root signature, seed it before validating the first candidate,
invalidate cached derived queries as that collection grows, and clear temporary
cache state in finally, including on validation errors. Protected objects and
both direct and foreign-model lookups need regression coverage.

No Core patch is included. The repository's agent guide explicitly requires
maintainer approval for Core changes. This issue is proposed to agree scope before
addressing the framework behavior. No production firewall was used.