Story 4.5 — Integration tests: golden render diff, CLI-vs-monitor parity, veth-restart

**Epic:** #740 — Validation, rollback & observability

Design: [v4 design](https://github.com/automa-saga/traffic-shaper/blob/main/docs/bn-qos-multiclass-priority-design-v4-nft-priority.md) §9.

Add the three integration-level checks beyond the data-plane POC.

**Acceptance criteria:**
- `network policy create` renders the expected `inet weaver` chain: diff against a golden file, fail-fast on divergence.
- `policy set --cidrs` and `policy add --cidr` reaching the same end state produce identical `nft list ruleset` (CLI and monitor paths cannot diverge).
- Monitor veth-restart resilience: restart the BN pod, confirm the qdiscs come back via the pod-lifecycle watcher and the next ingress packet classifies correctly.

Start with docs/bn-qos-multiclass-priority-design-v4-nft-priority.md §9 and the existing integration-test entry points. Add checks for the golden render diff, CLI-versus-monitor nft ruleset parity, and BN pod veth-restart recovery; done means all three acceptance criteria pass, including correct classification of the next ingress packet.

Written by the indexing model from the issue text.