feat(cilium): name the datapath device instead of probing for it

`devices` was empty, so each agent decided at start which links to attach
the eBPF datapath to. All three currently resolve to mgmt0, which is
correct — but it is a per-boot inference, stated in no file, over a
broadcast domain that also holds an address-less enp87s0. That asymmetry
is what #793 turned into a 13.5 h VIP outage: the UDM learned the node
address against the NIC with no BPF program on it. The sysctl guards
added there keep the wrong answer from being reachable; this makes the
right one reviewable.

Naming a single device also fixes the direct-routing device, which the
chart otherwise leaves to the same probe.

Behaviour-neutral by construction: `cilium-dbg status` reports exactly
`mgmt0 (Direct Routing)` on k8s-1, k8s-2 and k8s-3 today, and mgmt0 is
the only candidate — it holds the node address and both default routes.
Rendering the release's values through the 1.20.1 chart changes one line
of cilium-config, `devices: "" -> "mgmt0"`, and nothing else.

Two things this does not do. Upstream advises setting `devices` only
when auto-detection is unsuitable, and here it is not; the case for
naming it is that a datapath binding belongs in git, not that the probe
is wrong. And it is not enforcement: with no match the agent falls back
to probing rather than refusing to start, so a renamed link reverts to
auto-detection silently.

Merging rolls the agent DaemonSet through the reloader annotation, two
of three at once per its updateStrategy — the same path every
cilium-config change already takes.

Refs #576

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

kubernetes/infrastructure/cilium/helmrelease.yaml

@@ -65,6 +65,21 @@ spec:
     kubeProxyReplacement: true
     socketLB:
       enabled: true
+    # Which links the eBPF datapath attaches to: NodePort/LoadBalancer,
+    # masquerading, and — because this names exactly one — the direct-routing
+    # device. Left empty the agent probes for links with a non-local route,
+    # which resolves to mgmt0 on all three nodes today. Naming it makes the
+    # datapath's attachment a line in git instead of a per-boot decision.
+    #
+    # mgmt0 is the only candidate: it holds the node address and both default
+    # routes. enp87s0 shares its broadcast domain but carries no address, so
+    # the probe skips it — the asymmetry behind #793, where the UDM learned
+    # the node IP against that NIC and delivered to a link with no BPF program.
+    #
+    # Not a hard binding: with no match the agent falls back to probing rather
+    # than refusing to start, so a renamed link reverts to auto-detection
+    # silently. This declares intent; it does not enforce it.
+    devices: "mgmt0"
     prometheus:
       # Without agent metrics, BPF map utilisation is invisible: a full policy
       # map only shows up as "no space left on device" in the log while pod