Story 3.4 — Rebind on `ContainersReady`; best-effort cleanup on pod delete

**Epic:** #736 — BN traffic-shaper monitor

Design: [v4 design](https://github.com/automa-saga/traffic-shaper/blob/main/docs/bn-qos-multiclass-priority-design-v4-nft-priority.md) §8.1.1, §10 risk 3.

Re-install the veth qdiscs from the pod's `ContainersReady` event (not `Running`) to shrink the unprioritised-ingress window, clean up best-effort on delete, and proactively garbage-collect stale qdiscs.

**Acceptance criteria:**
- Bind on `ContainersReady` to bound the window to single-digit seconds in steady state.
- On pod delete: best-effort cleanup (the kernel auto-removes veth-attached qdiscs); mostly observational (logging, status update).
- On monitor **(re)start**, enumerate host veth qdiscs and reconcile against live BN pods, deleting orphaned HTB hierarchies left by a crashed monitor or a recycled veth name (design risk 3); surface stale/orphan detections via `/block_node/traffic_shaper/status` (#750).
- Document that ingress shaping is briefly unprioritised during the rebind window; nft ACLs and egress shaping are unaffected.

Read docs/bn-qos-multiclass-priority-design-v4-nft-priority.md sections 8.1.1 and 10, risk 3, then trace the monitor's pod event handling and /block_node/traffic_shaper/status entry point. Done means binding at ContainersReady, best-effort delete cleanup, restart reconciliation of stale host veth qdiscs, status reporting, and documentation of the brief ingress window.

Written by the indexing model from the issue text.