feat(cilium): gated WireGuard transparent encryption support (ADR-057 Phase 1)

[gangster]

What

Adds east-west in-transit encryption to the cilium module — the buildable half of ADR-057 (service identity & east-west zero trust). Capability only, default-off — a pure no-op until a unit opts in. Nothing is enabled or applied by this PR.

Why this half, now

• Phase 1 (this PR): transparent encryption — free (in-kernel WireGuard), applies to the standard tier, closes a real gap (pod-to-pod traffic is plaintext on the wire today).
• Phase 2 (parked): Cilium mTLS + SPIFFE workload identity — regulated-tier only (no regulated tenant exists yet), less mature, still has an open Cilium-mTLS-vs-SPIRE design question. Stays Proposed.

The change

• New gated vars (default off): encryption_enabled, encryption_type (wireguard default | ipsec), node_encryption.
• Wired as a distinct top-level encryption fragment in datapath_values.
• WireGuard chosen: in-kernel on the AL2023 6.x nodes (kernel 6.12, no key management) and simplest on the platform's overlay datapath (tunnel/VXLAN + cluster-pool) — sidesteps the WireGuard caveats that live in native-ENI mode. Cilium stacks it under the VXLAN tunnel and auto-adjusts MTU.
• ADR-057 amended in place — Phase 1 concretized; the ADR's open fleet-default vs tier-gated question resolved to fleet-default; node_encryption (host-to-host) deferred.
• README + Inputs table synced. tofu fmt/validate + markdownlint clean.

Enablement is a separate, deliberate step (not here)

Flipping a unit's encryption_enabled = true triggers a rolling Cilium restart on the CNI — the highest-blast-radius change on the platform. So enablement rolls out:

1. Preprod first, in a maintenance window, applied from the main checkout (never a worktree).
2. Measure the perf overhead + verify (cilium status → Encryption: Wireguard, connectivity, Hubble, ingress).
3. Platform follows once preprod is proven.

ADR-057 status flips to Accepted once applied + verified. Toward ADR-057 Phase 1.

🤖 Generated with Claude Code

[github-actions]

💰 Infracost report

Monthly estimate generated

Estimate details (includes details of unsupported resources)

──────────────────────────────────
77 projects have no cost estimate changes.
Run the following command to see their breakdown: infracost breakdown --path=/path/to/code

──────────────────────────────────
169 cloud resources were detected:
∙ 35 were estimated
∙ 130 were free
∙ 4 are not supported yet, see https://infracost.io/requested-resources:
  ∙ 1 x aws_athena_workgroup
  ∙ 1 x aws_ce_anomaly_monitor
  ∙ 1 x aws_ce_anomaly_subscription
  ∙ 1 x aws_cur_report_definition

_{This comment will be updated when code changes.}