Serve networkService backends at the edge

[scotwells]

A network service backend's endpoints are VPC pod addresses, so the edge has to reach them through the tenant's VRF rather than the default routing table, and a service with no healthy member should answer with a page saying the application is offline rather than the generic error page. This binds clusters built from network service backends to the tenant VRF the extension server resolves from the route's network, rejects a VRF name the device cannot carry, and turns off the panic threshold on those clusters so traffic is never sprayed at members whose holder has declared them unavailable. It also adds an embedded offline page with an optional override path, sourced the same way as the existing branded error page, and serves it when the edge had no healthy upstream to send a request to. This is the fifth of six stacked pull requests splitting the network services prototype, and it builds on the backend form from the fourth.

Test plan

• Unit tests cover VRF binding for network service clusters, including the rejected device name and other backends left alone
• Unit tests cover the panic threshold being disabled only for network service backends
• Unit tests cover offline page sourcing and the local reply selecting it on a no-healthy-upstream response
• Full test suite and lint pass in CI

[ecv]

Traced both halves of this one. The synthesized-slice name the cache index joins on matches what the HTTPProxy controller produces, the VRF device name matches the existing template, and the new BackendTrafficPolicy picks up its owner reference from the generic downstream-resource loop, so it goes when the route does. Zeroing the panic threshold so an all-unhealthy service fails closed rather than spraying is the right call, and the UH-matched offline page is a good touch.

Two small things, neither blocking:

In buildLocalReplyConfig, the first fallback resets BodyHTML and OfflineBodyHTML together, so an operator running a valid branded 5xx page plus a broken offline override loses the branded page too, not just the broken one. Validating each body on its own would keep the blast radius on the file that actually failed.

The networkService panic-threshold policy attaches to the whole downstream HTTPRoute, so a route mixing backend kinds across rules turns the threshold off for the others as well. Harmless today since nothing else configures health checking, and the comment says as much, but it is the kind of assumption that goes quiet when a future backend kind gains outlier detection.