[scotwells]

Summary

This adds the resource customers use to create a network load balancer. It covers TCP and UDP listeners, the backend services that receive traffic, health check settings, and a status that shows each location's address and hostname. Options the platform can't serve yet, such as IPv4, TLS and multiple backends on one listener, are part of the API but refused with a clear message when used. Nothing serves traffic yet.

Test plan

• API validation and admission tests pass
• Generated API schema and reference docs are up to date

First in the load balancer stack: #624, #712, #713, #714, #715, #716. Related to #611 and datum-cloud/enhancements#884

[kevwilliams]

Diff exceeds auto-review threshold (3654 lines). Flagging for human review.

[cla-assistant]

All committers have signed the CLA.

[ecv]

Approve.
Ran at 3d56f6e: go vet and the api, webhook, manager, agent and networkagent tests pass.
Ran TestNetworkLoadBalancerAdmission against envtest 1.31.0 and all 11 admission cases pass, so the CEL rules compile and enforce under a real apiserver.
CRD generation, kustomize validation and the generated-files check are green.
Nit: api/v1alpha/networkloadbalancerroute_types.go and the webhook treat a parentRef by listener name and a parentRef by port as different keys, so internal/webhook/v1alpha/networkloadbalancerroute_webhook.go:58-66 does not flag two refs that resolve to the same listener.
Fix in #713 by deduplicating on the resolved listener, since the route controller already collapses them in status.
Nit: config/quota adds registrations and claim policies but no grant, so projects get no allowance until a grant lands in infra.
Link the infra change before this reaches production.
Stack: first of #624, #712, #713, #714, #715, #716, each based on the previous branch, so merge in that order.