v0.4: freeze eBPF preview API, status, and threat boundary

Parent epic: #6
Research inputs: #65, #34

Freeze the public and security contract before implementation:

- `networking.waycloak.io/data-plane: ebpf-preview`; omission remains supported `sidecar`.
- administrator preparation intent versus executable observed node capability;
- initial scheduling versus runtime readiness and fail-closed response;
- stable node and `VPNWorkload` conditions/reasons;
- explicitly rejected feature combinations, including port forwarding until complete;
- node-agent/CNI capabilities, mounts, RBAC, AppArmor, seccomp, and blast radius;
- backend-neutral conformance matrix and no-fallback rule.

Acceptance: PRD, API contract, threat model, CRD/status sketches, and ADR 0024 agree; generated API work is split into implementation issues only after review.