Test that NetworkRule backends never resolve into another tenant's VPC #703

Summary

When two tenants use overlapping ULA space, one check is all that stops a rule's backend from resolving into the other tenant's VRF. That check depends on the gateway deriving the VRF name exactly the way the CNI writes it. Nothing tests either.

Add regression tests that pin this behavior before rules become tenant-writable.

Acceptance criteria

• A test with two tenants advertising the same backend prefix confirms each rule resolves only into its own VPC
• A test confirms a backend outside the rule's VPC never resolves, and the rule reports why
• A test fails if the VRF name the gateway derives and the name the CNI writes drift apart

Phase 1 of #698. Region and port checks on backends are #736 and #737.