Carry a VPC pod to the edge only when served

[scotwells]

Every VPC pod's endpoint slice is federated to every edge cluster, so a cell publishes one tenant's pod addresses and segment identifiers onto edges that serve other tenants and other locations, and nothing filters them because the facts that decide whether an edge needs a pod live in a project control plane a cell cannot read. This adds a hub-only record, written per project namespace by the control plane, of the workload addresses behind a proxy, and the cell's write-back carries a slice only when that record names one of its addresses. Silence keeps a pod published on purpose, since a route withdrawn under a pod that is still serving black-holes live traffic while a route left up for an idle pod costs a table entry. This is the last of six stacked pull requests splitting the network services prototype, and it adds the end-to-end scenario that proves a member serves a real request through the edge on its allocated address.

Test plan

• Unit tests cover resolving the record from proxies, services, and the interfaces they select
• Unit tests cover the write-back carrying a slice only when named, withdrawing one that stops serving, and holding on silence
• Build, vet, and the controller tests pass under envtest
• End-to-end scenario passes against the two-cluster environment in CI

[ecv]

Read through the reachability record and the gating it drives. The withhold-but-never-black-hole default and the resync ticker on the write-back side both look right, and the envtest cases around them are convincing.

One thing I want to ask before approving. publishedAddresses reads an EndpointSlice for every Instance backend a proxy names, but the controller watches only HTTPProxy, NetworkService and NetworkInterface, and it neither requeues nor runs a periodic pass. If an Instance backend's slice changes addresses with no event on those three types, is there anything that recomputes the record? From here it looks like it stays stale until the next unrelated proxy or interface change, and the write-back then gates VPC pod copies on an address set that no longer matches the workload.

Is the missing EndpointSlice watch deliberate, on the grounds that a slice change always comes with an interface change in practice? If it is, a comment saying so would help; if not, a watch or a resync mirroring vpcEndpointSliceResyncInterval would close it.

Smaller and not blocking: the record carries every family interfaceBackhaulAddresses returns, while the proxy path programs only the family addressOfType picks, so a dual-stack member advertises an address nothing routes to. Over-inclusive rather than wrong, but it costs some of the precision the record exists to give.