Enable native Pods to use a VPC as their primary network

[scotwells]

Why

Internal DNS needs one Pod on each compute and Connect gateway node, with Galactic as its primary VPC network. The same capability can support telemetry endpoints in consumer VPCs without introducing a DNS-specific deployment path.

What

• Add opt-in, cell-local attachment for native Pods and DaemonSets. Compute holds each Pod behind a scheduling gate until its VPC interface is allocated and prepared, then starts it with Galactic as eth0.
• Add a cell deployment overlay and focused controller/admission tests.
• Add a product enhancement covering the user experience, acceptance criteria, and rollout dependencies.

Validation

• go test ./internal/controller ./internal/webhook ./cmd -run 'TestPodNetwork' -count=1
• kustomize build config/overlays/cell-pod-network
• git diff --check github/main...HEAD

Before rollout

Establish a stable reference to Cloud's prepared NAD and verify late Multus annotation handling and detach/address release ordering in a cell. This PR is draft while those integration checks remain.