v0.4: certify mixed-mode signed release in the homelab

Parent epic: #6
Depends on #107-#113 and closes the v0.4 release cutoff.

Run release-candidate acceptance against exact signed artifacts:

- all default-mode unit/race/envtest/Kind or k3d and real-provider regressions;
- mixed sidecar and preview workloads in the homelab;
- amd64 and arm64 prepared-node install/rollback;
- packet capture across startup, CNI/agent/controller loss, failed update, gateway loss/replacement, node reboot, Pod reschedule, upgrade, and uninstall;
- full declared-feature conformance and explicit rejection of unsupported port-forward use;
- equivalent performance/footprint evidence demonstrating material value;
- signatures, SBOMs, provenance, vulnerability policy, reproducible CRDs/Helm, and immutable release manifest;
- cleanup proof: no acceptance resources, stale pins, or mutated unrelated CNI state.

The cutoff is binary: omit the preview rather than weaken fail-closed, rollback, compatibility, or value requirements.