Epic TS_4 — Validation, rollback & observability

Design: [v4 design](https://github.com/automa-saga/traffic-shaper/blob/main/docs/bn-qos-multiclass-priority-design-v4-nft-priority.md) §9, §11 (Validation and rollback), §10 risks 18/19.

Implement validation, rollback, and observability for the BN traffic shaper (v4), including the regression gate that protects the design's single load-bearing empirical claim.

**Scope:**
- Per-poll-tick validation (nft hash diff, tc no-filters assertion, per-category liveness probe) with per-BN auto-rollback to `weaver-prev.conf`.
- Egress-priority survival regression test (companion POC Stage 2.4) on every Cilium/kernel upgrade; documented fallback to the alternative egress layer (§6.5).
- nft counters exported to Prometheus; document the loss of Hubble flow visibility.
- Integration checks: golden-file nft render diff, CLI-vs-monitor identical-state, monitor veth-restart resilience.