Add service-route observability

[scotwells]

Summary

Add bounded-cardinality observability for the node-local private-service controller and TC-eBPF dataplane introduced by #634.

• Record reconciliation outcomes and duration.
• Record eBPF apply/remove outcomes and the number of attachment-scoped paths currently tracked.
• Emit structured policy, endpoint, node, attachment-count, dependency, and programming failure context in logs.
• Export service_route_denied and service_route_redirect_failed without exposing diagnostic trace slots as metrics.
• Scrape galactic-cni port 9180 with a PodMonitor.
• Keep resource names out of metric labels.

Validation

go test ./internal/plumbing/ebpf/prog ./internal/plumbing/ebpf/serviceroutemap ./internal/plumbing/ebpf/attach ./internal/plumbing/ebpf/metrics ./internal/serviceroute ./internal/controller ./cmd/galactic-router -count=1
go vet ./internal/plumbing/ebpf/metrics ./internal/serviceroute ./internal/controller ./cmd/galactic-router

The base branch was changed.