v0.4: certify mixed-mode signed release in the homelab

Parent epic: #6
Depends on #107-#113 and closes the v0.4 release cutoff.

Run release-candidate acceptance against exact signed artifacts:

- all default-mode unit/race/envtest/Kind or k3d and real-provider regressions;
- mixed sidecar and preview workloads in the homelab;
- amd64 and arm64 prepared-node install/rollback;
- packet capture across startup, CNI/agent/controller loss, failed update, gateway loss/replacement, node reboot, Pod reschedule, upgrade, and uninstall;
- full declared-feature conformance and explicit rejection of unsupported port-forward use;
- equivalent performance/footprint evidence demonstrating material value;
- signatures, SBOMs, provenance, vulnerability policy, reproducible CRDs/Helm, and immutable release manifest;
- cleanup proof: no acceptance resources, stale pins, or mutated unrelated CNI state.

The cutoff is binary: omit the preview rather than weaken fail-closed, rollback, compatibility, or value requirements.

Read the parent epic #6 and dependencies #107-#113 first, then run the release-candidate checks against the exact signed artifacts: unit, race, envtest, Kind or k3d, provider, homelab, architecture, packet-capture, conformance, performance, supply-chain, and cleanup checks. Done means every stated requirement has evidence; otherwise omit the preview without weakening the fail-closed, rollback, compatibility, or value requirements.

Scritto dal modello di indicizzazione a partire dal testo della issue.