v0.4: add explicit preview admission scheduling and workload status

Parent epic: #6
Depends on #107 and the node capability contract from #109.

Implement explicit admission and reconciliation for `networking.waycloak.io/data-plane: ebpf-preview`:

- omitted value remains sidecar; unknown values reject;
- required initial affinity combines administrator preparation intent and observed capability;
- unsupported nodes/features produce stable admission or Pending reasons;
- `VPNWorkload` records requested/observed mode, node, attached generation, and observed readiness;
- runtime label/capability loss retains deny and reports NotReady;
- no automatic or failure-time fallback;
- unannotated/default workloads and existing adapters remain unchanged.

Cover webhook upgrades, stale labels, direct `nodeName`, rapid replacement, mixed-mode scheduling, and controller/node-agent loss in envtest and live-cluster acceptance.