feat: Enable CUSTOMER_ROUTED control plane egress by default on workshop clusters

## Summary

Enable EKS Control Plane Egress through customer VPC (`CUSTOMER_ROUTED` mode) by default on all PeEKS clusters (hub and spokes).

## Motivation

`CUSTOMER_ROUTED` is a security best practice for production EKS platforms:

- All admission webhook traffic (Kyverno) routes through the customer VPC — auditable via VPC Flow Logs
- Enables private OIDC providers (no internet exposure for auth traffic)
- Allows applying security groups, Network Firewall, and VPC endpoint policies to control plane egress
- Organization-wide enforcement via SCP (`eks:controlPlaneEgressMode` condition key)
- Production-ready by default — customers reusing PeEKS blueprints get this security posture out of the box

## Reference

- **Blog:** https://aws.amazon.com/blogs/containers/amazon-eks-now-supports-control-plane-egress-through-your-vpc/
- **Docs:** https://docs.aws.amazon.com/eks/latest/userguide/control-plane-egress.html
- **Launch date:** June 22, 2026

## Implementation

One-liner in cluster creation config:

```yaml
controlPlaneEgressConfig:
egressMode: CUSTOMER_ROUTED
```

Apply to both hub and spoke cluster templates.

## Notes

- EKS Capabilities (ArgoCD, ACK, kro) traffic does NOT flow through customer VPC (runs on AWS infra) — no impact on Capabilities functionality
- Available in all commercial regions

Find the hub and spoke cluster creation templates and inspect their current egress configuration. Add controlPlaneEgressConfig with egressMode CUSTOMER_ROUTED to both templates; done means both cluster configurations enable this mode by default without changing EKS Capabilities behavior.

Written by the indexing model from the issue text.