epic: ship the v0.4.0 optional eBPF node-data-plane preview

## Outcome

Research #65 and #34 selected the prototype-release outcome and E2 architecture. v0.4.0 is an optional developer preview: a chained CNI creation-time handoff installs Pod-parent cgroup eBPF default-deny and a prepared-node agent adopts the exact UID/generation state. The supported nftables/netlink sidecar remains the default; there is no fallback.

PRD: `docs/product/release-scope-v0.4.md`
Research: `docs/research/ebpf-data-plane.md`
Decision: ADR 0024
Draft PR: #106

## Ordered implementation graph

1. #107 — freeze API, status, conformance, and threat boundary.
2. #108 — prove exact containerd CNI UID/netns/cgroup deny-before-start handoff.
3. #109 — implement node capability and eBPF link/pin lifecycle ownership.
4. #110 — prove node ownership of VXLAN, routes, DNS, health, and drift repair.
5. #111 — implement explicit preview admission, scheduling, status, and no fallback.
6. #112 — package atomic prepared-node install, upgrade, rollback, and uninstall.
7. #113 — run equivalent default/tuned-default/preview performance and footprint study.
8. #114 — certify the exact signed mixed-mode release in the homelab.

#108 and #107 can begin after the research PR is accepted. #109 depends on the handoff proof. #110 is the sidecar-reduction and threat-model gate. #111 consumes the frozen contract and capability status. #112 packages only proved behavior. #113 requires a complete equivalent path. #114 is the final cutoff.

## Release cutoff

The preview ships only if it owns a complete declared feature subset, removes the privileged networking sidecar or demonstrates another accepted material benefit, passes backend-neutral fail-closed lifecycle tests on amd64 and arm64, coexists with ordinary sidecar workloads, and has safe CNI rollback. Unsupported features are rejected. If a gate remains unproved, omit the preview rather than weaken it.