atunnel: egress listener accepts IPv6 connections it cannot route

Sub-task of #246, part of bowei's [step 3](https://github.com/agent-substrate/substrate/issues/246#issuecomment-4771177881).

`atunnel-egress-listen-address` defaults to `0.0.0.0:15001` and is opened with `net.Listen("tcp", ...)`. Go treats every unspecified address as a wildcard, so this binds `::` dual-stack and accepts IPv6. `TCPOriginalDestination` then cannot recover the original destination, because it reads only the IPv4 `SOL_IP`/`SO_ORIGINAL_DST` — the connection is accepted and fails.

This issue originally read as "both listeners bind `0.0.0.0`, so IPv6 clients cannot reach them". That premise was wrong: `0.0.0.0` does not restrict the address family in Go, so actor ingress was already reachable over IPv6 on an IPv6-only cluster. The real defect is the reverse — egress accepts a family it cannot handle.

Making egress genuinely dual-stack needs #945 (actor veth addressing) and #686 (`IP6T_SO_ORIGINAL_DST`).