[Nexthop] warmboot-finalizer: re-enable FLOW_CNT_TRAP after warm-boot reconcile

[wren-nexthop]

Why I did it

Resolves #28895

Pairs with sonic-utilities PR sonic-net/sonic-utilities#4756: with trap flow counters enabled, warm reboot crash-loops orchagent (Broadcom SAI fails the HOSTIF trap counter replay during APPLY_VIEW), so the warm-reboot script disables FLOW_CNT_TRAP before the warm shutdown. Something then has to re-enable the group once reconcile completes, or trap flow counters silently stay off after every warm reboot.

Work item tracking

• Microsoft ADO (number only): N/A

How I did it

• finalize-warmboot.sh re-enables FLEX_COUNTER_TABLE|FLOW_CNT_TRAP after reconcile if — and only if — the reboot script left the marker /host/warmboot/flow_cnt_trap_need_re_enable, then removes the marker. The marker distinguishes "the reboot script disabled this on the user's behalf" from "the user had it disabled".
• On non-warm boot paths, a stale marker from a prior aborted warm-reboot is dropped without touching user configuration.

How to verify it

1. Enable FLOW_CNT_TRAP in CONFIG_DB, sudo warm-reboot with the paired sonic-utilities change.
2. After the finalizer completes: FLEX_COUNTER_TABLE|FLOW_CNT_TRAP is back to enable, the marker is gone, and show flowcnt-trap stats works.
3. Cold boot with a stale marker present: marker is removed and the counter group is left untouched.

Verified on Broadcom Tomahawk-based platforms together with the paired sonic-utilities change.

Which release branch to backport (provide reason below if selected)

• 202305
• 202311
• 202405
• 202411
• 202505
• 202511
• 202512
• 202605
• 202608

Backport reason: required for warm reboot support on Broadcom Tomahawk platforms in 202512 (warm reboot fails with trap flow counters enabled without this fix + the paired sonic-utilities change).

Tracking issue/work item for backport/cherry-pick request (GitHub issue or Microsoft ADO): #28895
Failure type: day-one issue

Tested branch

• master

[mssonicbld]

/azp run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

This PR has backport request for branch(es): 202512.
Added label(s) for branch(es) msft-202512.

_{---Powered by SONiC BuildBot}

[mssonicbld]

This PR has backport request label(s) for branch(es): msft-202512, but is missing required test information. Please make sure you tick the tested branch(es) in the Tested branch section and provide test evidence (e.g., 202512: <test result>) in the Test result section as well in your PR description.

_{---Powered by SONiC BuildBot}