🐛 ICMPv6 proxy selects loopback ::1 instead of interface GUA on IPv6-only host

**Describe the bug**
On an IPv6-only Linux host, the ICMP proxy always selects `::1 in zone lo` as the IPv6 source address, ignoring the global unicast addresses on the network interface ens18. This makes ICMPv6 proxying non-functional for private network routing via WARP. TCP and UDP proxying work fine.

**To Reproduce**
Steps to reproduce the behavior:
1. Configure an IPv6-only Linux host (no IPv4 on the interface, GUA assigned via SLAAC or static)
2. Run `cloudflared tunnel run` with `warp-routing: enabled: true`
3. Check logs: `journalctl -u cloudflared | grep ICMP`
4. ICMP proxy binds to `::1` instead of the interface GUA

If it's an issue with Cloudflare Tunnel:
4. Tunnel ID : `5f000cd6-96fa-41f4-86b2-c693002d572a`
5. cloudflared config:
```
tunnel: 5f000cd6-96fa-41f4-86b2-c693002d572a
credentials-file: /root/.cloudflared/5f000cd6-96fa-41f4-86b2-c693002d572a.json
edge-ip-version: "6"
warp-routing:
enabled: true
```

**Expected behavior**
The ICMP proxy should select a GUA on `ens18` as the IPv6 source.

**Environment and versions**
- OS: Debian 13 (Trixie)
- Architecture: AMD64
- Version: 2026.3.0

**Logs and errors**
```
INF ICMP proxy will use 0.0.0.0 as source for IPv4
INF ICMP proxy will use ::1 in zone lo as source for IPv6
```
Interface has a GUA available:
```
2: ens18: mtu 1500 qdisc fq_codel state UP group default qlen 1000
inet6 2a06:d1c1:80::xxxx:xxxx:xxxx:xxxx/64 scope global dynamic mngtmpaddr proto kernel_ra
inet6 fe80::xxxx:xxxx:xxxx:xxxx/64 scope link proto kernel_ll
```

**Additional context**
Adding a static GUA (/64, scope global) to ens18 did not change the behavior either. The host has no IPv4 addresses on any interface other than loopback, which may be why the detection logic falls through to ::1.