refactor(api)!: Rename NetworkRule to NetworkService

[privateip]

Summary

The load-balanced ingress object on a VIP and port with selected backends was called a rule, which misdescribes it, so this renames the kind and its Go types to NetworkService. Fields, JSON keys, validation and behaviour are unchanged, and there is no alias or conversion since v1alpha1 makes no compatibility promise.

The network services operator already defines a NetworkService in another API group, but its CRD reaches only the Milo control plane while these CRDs reach only edge cells, so no cluster serves both kinds and a lookup by the shared name stays unambiguous wherever either is installed.

Breaking changes

Existing objects are not migrated by the rename. These follow-ups are not part of this PR:

• galactic: bump the network module, rename the NetworkRule controller, binding controller and every type reference, the CRD names helper, containerlab resources and docs.
• infra: the galactic-gateway RBAC template and its rendered copies, the galactic edge app sync and the galactic-system agent guide.
• Live clusters: export, delete and recreate existing objects as NetworkService during the galactic rollout, then delete the old CRD.

Test plan

• No old kind, plural or short name remains outside design records
• Regenerating the CRDs and API docs leaves no diff
• Build, lint, unit and e2e tests pass

🤖 Generated with Claude Code

[privateip]

What a release of this does to running cells. Every edge cell applies the newest network tag through infra's galactic-crds Flux Kustomization (apps/galactic-system/edge/crds.yaml), which has prune: false. A tag with this change adds networkservices.network.datumapis.com beside the existing networkrules.network.datumapis.com and deletes nothing, so existing NetworkRule objects and the galactic-gateway that reads them keep working until galactic moves to the new kind. Remove the old CRD by hand only after that migration, because deleting it deletes every NetworkRule.

Where the colliding NSO kind lives, read at infra main 0844442f8:

networking.datumapis.com/NetworkService   NSO config/crd (full bundle)
  -> apps/network-services-operator/control-plane/base/core-control-plane-resources.yaml
     kubeConfig milo-configuration-kubeconfig, path upstream_resources   (Milo core control plane only)
NSO crd/downstream (hub and cells)         no networkservices
network.datumapis.com (this repo)          apps/galactic-system/edge/crds.yaml   (edge cells only)

The NetworkRuleConfig documents in infra's provisioning/templates/*/controlplane.yaml are Talos host firewall config, not this kind, and need no change.

Open network#35 adds a CEL rule to the old rule_types.go. Whichever of the two lands second rebases, and the marker moves to networkservice_types.go.