Edge gateway starts without the forwarding sysctls its FIB lookup needs #586

Summary

The edge gateway needs IPv6 forwarding enabled on every interface it attaches to. Without it, the kernel FIB lookup the datapath relies on refuses every packet, and the datapath drops everything it is handed.

The gateway tries to set those sysctls at startup. The pod's /proc/sys is read-only, so the writes fail. The failure is logged as a warning, and the process carries on and reports healthy. This happens on every node running the datapath, including ones whose uplinks are otherwise fine.

The startup code looks like it treats the failure as fatal, but the helper it calls logs each failure and always returns success, so the error branch never runs. A comment calls the step best-effort, which matches what happens. The unreachable branch is what misleads.

Two things are wrong on their own: the DaemonSet does not get a writable /proc/sys, and a datapath that cannot forward starts anyway.

First reported in #583, which is about a separate defect in the same startup path.

Acceptance criteria

• The gateway pod can write the forwarding sysctls it needs
• A gateway that cannot enable forwarding fails visibly instead of running a datapath that drops every packet
• The unreachable error branch and the comment disagreeing with it are reconciled

Phase 0 of #698.