Actor egress has no fallback when a destination family has no path

Part of #246.

A worker pod can hold a global unicast address in a family that has no path off the node. Dual-stack kind is the case in hand: pods get `fd00:10:244::/64`, a ULA with no route out, and `curl -6` fails from the node itself. #1057 gates the actor's IPv6 on the pod having a global IPv6 address, which is correct and still says yes here — `IsGlobalUnicast()` is true for `fc00::/7`, and no addressing check can tell a ULA from a routable prefix.

The actor then picks the AAAA and the connection is accepted locally rather than refused, because the egress REDIRECT makes every destination look reachable. It dies mid-stream instead of failing to connect, so Happy Eyeballs never falls back to IPv4. Refusing at accept time when the destination's family has no path would turn that into an ordinary connect failure and let the fallback work.

This is what blocks the `dual` axis of the IP-family e2e matrix: `TestActorEgress` and `TestActorEgressHTTPS` fail on a dual-stack kind cluster today, so adding the axis lands two red tests on day one.