Story 4.3 — Egress-priority survival regression gate (companion POC Stage 2.4)

**Epic:** #740 — Validation, rollback & observability

Design: [v4 design](https://github.com/automa-saga/traffic-shaper/blob/main/docs/bn-qos-multiclass-priority-design-v4-nft-priority.md) §6.4, §10 risks 18/19, §12.

Implement the recurring regression test for the single load-bearing empirical claim: `meta priority` set in `FORWARD` survives to the `$EGRESS` HTB qdisc.

**Acceptance criteria:**
- Reproduce companion POC Stage 2.4: partner traffic shows bytes in class 1:40 with overlimits > 0 on `$EGRESS`.
- Gate it to run on every Cilium / kernel upgrade.
- On failure: document and enable the alternative egress layer (§6.5), keeping the nft ingress + ACLs + sets.
- Also assert `BandwidthManager: Disabled` as part of the gate.

Start with docs/bn-qos-multiclass-priority-design-v4-nft-priority.md, especially §6.4, §6.5, §10, and §12, then review companion POC Stage 2.4. Done means the recurring gate reproduces partner traffic in class 1:40 with egress overlimits, asserts BandwidthManager is disabled, runs for Cilium and kernel upgrades, and documents the alternative egress layer on failure.

Written by the indexing model from the issue text.