The gateway canary passes without proving traffic flowed

[ecv]

What needs to happen

The new two-node canary in the lab checks that the gateway's custom resources are present and that the pods are up. It does not check that a packet reached a backend through the gateway.

A canary that passes on presence alone reports success in exactly the situation it exists to catch: everything deployed, nothing forwarding. The lab has already produced one failure of that shape, where a detached program left every control-plane signal looking correct while traffic bypassed the datapath entirely.

The task description is honest that this is a first cut, which is why this is a follow-up rather than a review comment.

Why this matters

The canary is the only thing in the repository that exercises the datapath end to end. Unit tests cover the map and rule bookkeeping, and nothing else runs a packet through an attached program.

While it asserts presence, the coverage it appears to give is larger than the coverage it has.

Desired outcome

1. Send traffic to a virtual address from outside the gateway node and assert it arrives at a backend.
2. Assert the packet and byte counters for that rule moved, which also proves the counters are wired to the path the traffic took.
3. Fail loudly when the two disagree, since presence without forwarding is the case worth naming.

Found while reviewing #355.