Replace actor eth0 move with veth networking

[EItanya]

Related issue: agent-substrate#122

Summary

This replaces the ateom-gvisor networking path that moved the worker pod's Kubernetes-provided eth0 into the actor/gVisor network namespace.

Instead, the worker pod keeps its real eth0, and ateom-gvisor creates a point-to-point veth pair between the worker pod namespace and the actor namespace. The actor-side peer is renamed to eth0, receives the actor-side address, and uses the worker-side veth as its default gateway.

The PR also adds temporary nftables compatibility rules so existing inbound and outbound behavior continues to work while preserving the worker pod's own network connectivity.

Why

Moving the pod's real eth0 makes the worker pod lose normal Kubernetes network connectivity while an actor is active. That blocks pod-local networking components, including the planned transparent egress capture and AgentGateway integration, because those components remain in the worker pod namespace while actor traffic leaves through an interface that was moved elsewhere.

Keeping eth0 in the worker pod namespace gives Substrate a stable worker-owned networking boundary for future transparent egress policy enforcement.

Validation

• go test ./cmd/ateom-gvisor ./cmd/atelet ./internal/ateompath ./internal/controllers
• go test ./cmd/ateom-gvisor ./internal/serverboot
• NO_DEV_ENV=true BUCKET_NAME=ate-snapshots KO_DOCKER_REPO=localhost:5001 KUBECTL_CONTEXT=kind-kind ./hack/run-e2e.sh ./internal/e2e/suites/demo -run TestDemo3 -count=1

Checklist

• Tests pass
• Appropriate changes to documentation are included in the PR