feat(gateway): add egress masquerade datapath to edgenat.c

[privateip]

Summary

Phase B of #865, per docs/plans/865-edge-gateway-nat66-egress.md §3.
Stacked on #380 (Phase A).

• egress_config_table, egress_conn_table, handle_egress_forward,
  handle_egress_return, updated 4-way dispatch in edge_nat().
• tenant_arg (egress_sid's uFMT Argument bits) keys the forward row,
  so two tenants with colliding ULA backend addresses never collide in
  egress_conn_table.
• New drop reasons, plumbed through dropreason.go.

Flagged for review

• backend_usid (needed to route replies back to the originating
  worker node) has no per-tenant policy table in Phase B. Resolved by
  reading it off the wire -- the egress-forward packet's own outer
  SRv6 source address, captured before the outer header is stripped.
  Assumes RouteEgressAdd's SEG6 encap route always stamps the
  originating node's own uSID as that outer source, consistent with
  every other cross-node SRv6 packet in this codebase -- not
  independently verified here. Marked in the code; worth confirming
  before Phase D's e2e proof depends on it.
• handle_egress_return drops any non-TCP/UDP protocol addressed to
  masq_addr (e.g. ICMPv6) rather than passing it to the kernel
  stack -- same fail-closed convention gw_addr's own return branch
  uses for claimed addresses, but a real cost for an internet-facing
  address that gw_addr's internal-only precedent didn't have to
  weigh.

Testing

• New root-required tests in edgenat_egress_test.go: both branches
  end-to-end (SNAT/DNAT, checksum, real FIB-resolved L2), non-SYN/no-conn
  drops, PAT exhaustion, and the tenant-isolation scenario §6 calls out
  explicitly (colliding backend/dest tuple, distinct tenant_arg ->
  two independent rows and masq_port allocations).
• go build ./..., go vet ./..., task lint (0 issues) -- clean.
• Full edgenat suite passes under root + -race.
• Broader task test:unit: one pre-existing, unrelated failure in
  internal/cni/tap (environment-specific -- confirmed on the
  unmodified branch too).

🤖 Generated with Claude Code

[privateip]

The test failures are expected. Need to merge datum-cloud/network#15 first.