v0.4: compare default tuned-default and complete preview data planes

Parent epic: #6
Extends research issue #34 and depends on a complete feature-equivalent path from #110.

Run the controlled comparison required by the v0.4 PRD:

1. current two-second nftables/netlink sidecar;
2. diff/event-driven default-sidecar control;
3. complete preview node path.

Measure total node and per-Pod CPU/memory, startup/recovery, container/image footprint, reconciliation and drift repair, TCP throughput/latency, UDP loss, UDP/TCP DNS, generation updates, and gateway-loss enforcement at 1, 10, 50, and feasible stress counts. Run amd64 and arm64 with exact kernel/runtime/CNI/LSM identity.

Separate deterministic fake-gateway packet/backend results from real-provider membership-burst recovery. No eBPF performance claim is allowed unless equivalent behavior and total node cost are reported.

Start by reading the parent epic #6, research issue #34, dependency #110, and the v0.4 PRD because this issue depends on that context. The work is to run the three listed data-plane comparisons on amd64 and arm64 with identical kernel/runtime/CNI/LSM conditions. Done means a report covers all named CPU, memory, startup, footprint, reconciliation, throughput, loss, DNS, generation, and gateway-loss metrics, separating fake-gateway from real-provider results.

Vom Indexierungsmodell aus dem Issue-Text verfasst.