Shard egress-lane VMs over several raw bridges

[CMGS]

#58 gave the egress lane its shard list, but over CNI conflists — and the CNI attachment is what it prices in: every clone pays a network namespace, a CNI plugin execution, a veth pair and a TC redirect. Measured on a 384-core host filling 1000 egress VMs to exec-probed warm (quiet console, udev exec queue stopped, refill_concurrency: 64, same harness for every row):

attachment	rate	note
networks ×4 (#58, CNI)	25.8/s	spread even: 261/235/248/257
bridge ×1 (raw tap)	48.0/s	the single-bridge ceiling story from #58 applies
bridges ×4 (this PR, raw tap)	83.3/s	spread even: 245/233/250/272
4 separate daemons, one bridge each, meshed	82.2/s	for context — this PR matches it in one process, one golden set

What it adds

bridges — a list of host bridge devices, sharded by the same stable VM-name hash networks uses, with the raw TAP-on-bridge attachment kept: one tap in the root netns, one RTM_SETLINK, no netns, no plugin process, no veth. Each entry is one Linux bridge, so N entries give N×BR_MAX_PORTS exactly like the conflist form.

Two consequences fall out of the taps staying in the root netns:

• Guarded egress works over bridges. The nft NIC lock needs the tap reachable from the root netns, which is why guarded egress rejects networks at load; a bridges list satisfies it, so the guarded lane is no longer capped at one bridge.
• A one-entry list is byte-for-byte the scalar bridge argv.

Shape

• The scalar bridge key is retired the same way network was in Spread egress-lane VMs over several CNI networks #58: strict config decoding rejects it loudly, and the deploy docs carry the one-line rename ("bridge": "br0" → "bridges": ["br0"]). bridges and networks are mutually exclusive, with the same empty-name/duplicate validation.
• engine: networkFor generalises to shardOf(shards, name) — same fnv hash, so a persisted record's attachment stays reproducible without process state, for either form.
• lockEgress arms for any bridge form.
• Docs: the deploy table row and the guarded-egress bridge-lane note now name both forms.

Verification

make go-lint (golangci, GOOS linux+darwin) 0 issues; go test -race green on config/engine/pool and e2e; gofmt clean. On hardware: the 1000-VM fill above, hash spread within 9% of even across four bridges, and the pool drained clean afterwards. Only refill_concurrency: 64 was measured for the new form.