[scotwells]

Summary

• Move VPC creation, subnet programming status, VPCAttachment and NAD reconciliation from Galactic's cell controller to NSO's cell manager. Galactic's cell role now owns BGP advertisement status projection and traffic policy.
• Preserve the Galactic BGP handoff: an attachment group change invalidates stale NSO interface and claim programming, and the new-group advertisement restores it.
• Remove the Galactic attachment mode flag and VPC/NAD write permissions; update the migration runbook.

Verification

• go test ./internal/cloud/controller ./internal/cloud/galactic ./internal/cloud/webhook ./cmd/galactic-controller -count=1 passed.
• go vet ./internal/cloud/controller ./internal/cloud/webhook ./cmd/galactic-controller passed.
• task ci remains blocked on this macOS host because llvm-strip is unavailable; GitHub CI covers the full pipeline.

Rollout

NSO's Galactic reconcilers are disabled by default. Install CRDs, stop the old VPC cell writer, and enable NSO before unsuspending Galactic's BGP status controller. Staging infra remains a draft migration and is not ready to merge.

Companion PRs: datum-cloud/network-services-operator#662 and datum-cloud/infra#7107.