Run galactic-gateway in the containerlab lab with an end-to-end VIP check #699

Summary

galactic-gateway has no end-to-end coverage. The containerlab lab stopped deploying it, and the check it had before never sent real traffic through a VIP. The one ingress outage we know of was found because traffic stopped, not by a test.

Put the gateway back in the lab on the edge nodes, running alongside the egress shards the way production does. The gateway holds the uplinks, and galactic-nat runs behind it in chained mode.

datum-cloud/enhancements#884 binds a load balancer to one region in its first phase, and each lab site stands in for a region, so the check keeps a VIP and its backends in one site.

Acceptance criteria

• The lab deploys galactic-gateway and a NetworkGateway on at least two edge nodes in one site, plus one in a second site
• The egress shards on those nodes run in chained mode, and the existing NAT checks in task verify still pass
• A new task verify check sends TCP and UDP from the off-fabric host to a VIP and confirms replies from backends in the VIP's own site, through each of that site's gateway nodes
• The check fails if the gateway's XDP program is detached from the uplinks

Phase 0 of #698. #736 extends this check to prove a VIP isn't served through the second site.