Move Galactic VPC programming into NSO cell manager

[scotwells]

Summary

• Move the Galactic VPC, subnet status, and network interface attachment reconcilers into NSO's cell manager. NSO now creates galactic.datumapis.com VPCs and VPCAttachments, writes NADs, and updates the NSO attachment reference.
• Keep tenant-facing NSO CRDs in networking.datumapis.com. Gate the new reconcilers behind galactic.enabled and require an explicit attachment mode, so an NSO upgrade can precede the old VPC controller shutdown.
• Generate the cell manager RBAC and config deepcopy; retain the regression test that checks the new attachment group through reconcile, release, and rebind.

Verification

• make manifests generate passed.
• go test ./internal/galactic/... ./internal/cmd/cell ./internal/config ./internal/controller ./internal/cmd/manager -count=1 passed (run as focused package invocations).
• go vet ./internal/galactic/... ./internal/cmd/cell ./internal/config passed.
• go test ./internal/... -run '^$' compiled all internal packages.

Rollout

Merge the NSO code before enabling galactic.enabled in any cell. Install Galactic CRDs, stop the old VPC cell controller, then enable NSO with the cell's attachment mode. The staging infra PR remains draft pending the identity and object migration and live inventory.

Companion PRs: datum-cloud/galactic#886 and datum-cloud/infra#7107.