v0.4: prove node ownership of VXLAN routing DNS and drift repair

Parent epic: #6
Depends on the CNI handoff and node-agent ownership core.

Prototype node ownership of the complete non-port-forward feature subset after the cgroup deny is attached: VXLAN, overlay address, protected and exception routes, all cluster-traffic modes, UDP/TCP DNS translation, gateway health, endpoint replacement, verification, and drift repair.

Measure and document every required namespace/capability/host access. `CAP_SYS_ADMIN` or host PID is not implicitly accepted. Preserve unrelated netns and CNI state. The selected path must remove the two privileged networking init operations and long-running privileged networking sidecar or the release-value gate fails.

PortForwardLease remains rejected until its DNAT and renewable-delivery path is complete.