v0.4: compare default tuned-default and complete preview data planes

Parent epic: #6
Extends research issue #34 and depends on a complete feature-equivalent path from #110.

Run the controlled comparison required by the v0.4 PRD:

1. current two-second nftables/netlink sidecar;
2. diff/event-driven default-sidecar control;
3. complete preview node path.

Measure total node and per-Pod CPU/memory, startup/recovery, container/image footprint, reconciliation and drift repair, TCP throughput/latency, UDP loss, UDP/TCP DNS, generation updates, and gateway-loss enforcement at 1, 10, 50, and feasible stress counts. Run amd64 and arm64 with exact kernel/runtime/CNI/LSM identity.

Separate deterministic fake-gateway packet/backend results from real-provider membership-burst recovery. No eBPF performance claim is allowed unless equivalent behavior and total node cost are reported.