feat(gateway): wire egress control plane and admission webhook

[privateip]

Summary

Phase C of #865, per docs/plans/865-edge-gateway-nat66-egress.md §4-§5.
Stacked on #381 (Phase B).

• config.GatewayConfig gains EgressAddress/EgressSID, optional
  but validated as a pair.
• gateway.NewKernelDatapath optionally writes egress_config_table;
  zero value means no egress on this node.
• gateway.DesiredEgressPolicy defined but not added to EngineState
  -- routing-only enablement means nothing in Engine/Datapath consumes
  it yet.
• NetworkGatewayReconciler.publishEgressAddress publishes
  status.EgressAddress and a self-address BGP route, kept separate
  from publishSelfAddress since the two fields are independently
  optional.
• webhook.Authorizer narrowed from *NetworkRule to
  (vpcRef, vpcAttachmentRef string), so the new
  NetworkEgressPolicyValidator shares it with NetworkRuleValidator
  instead of duplicating the interface. Wired into cmd/galactic-router
  alongside the existing validator.
• cmd/galactic-gateway CLI flags/config plumbed through to
  setupGatewayDatapath.

Scoping note

The plan's §4.3 also describes a NetworkEgressPolicy watch/reconcile
loop mirroring NetworkRule's list-and-assemble pattern. Left out here:
it has no well-defined per-policy work until Phase D decides node
assignment, and a watch that lists objects and does nothing with them
is dead scaffolding, not a real feature.

Testing

• New tests: config pairing/family validation, NewKernelDatapath
  mismatched-pair/IPv4 rejection, reconciler publish/skip-publish,
  webhook create/update/delete/fail-closed plus a test proving one
  Authorizer instance serves both validators.
• go build ./..., go vet ./..., task lint (0 issues) -- clean.
• Full task test:unit under root: everything this PR touches passes.
  Two unrelated failures present (internal/cni/tap,
  internal/cniroute) are environment artifacts -- confirmed
  cni/tap fails identically on the unmodified branch, and
  cniroute passes cleanly in isolation.

🤖 Generated with Claude Code