Requirements for Ateom within Pod network setup

This is a follow-on for https://github.com/agent-substrate/substrate/issues/122. The purpose of this issue is to gather discussions on requirements for the within Pod network.

The general question that has come up is what are the guarantees on the shape of the within Pod i.e. Ateom wiring for the sandbox. Whatever we come up with:

1) It must work with multiple sandbox technologies (gVisor, uVM such as Cloud Hypervisor etc).
2) Be compatible with Kubernetes CNIs. There is a slight asterisk here as the variety of things that are configured via CNI can be very varied so it may not be possible to cover every potential case. A good test would be that widely deployed CNIs should be compatible out of the box without modification.

The current straw proposal is to have:

```
+----------------+ +------------+
| ateom0 <------> eth0 |
| ? | | Sandbox NS |
| Pod NS veth0 | +------------+
+-------------|--+
|
(CNI)
|
V
```