v0.8.0: Load balancer health checks and the Galactic Edge agent

Gateways health-check load balancer backends and can fail closed when none is healthy, load balancers can live in project namespaces, and a new edge agent ships alongside opt-in Spread service endpoints.

What's new

• Backend health checks. Each backend's own node probes it, gateways leave out backends that fail, refused probes are retried within the timeout, and stale reports expire. (#1010, #1012, #1013, #1126, #1139)
• Fail-closed health, opt-in per service. A FailClosed service with no healthy backend stops serving and reports NoHealthyBackends. (#1117, #1138)
• Load balancers in project namespaces, and session affinity. (#1106, #1005)
• Datapath fixes. VIP replies survive a gateway with its datapath off or a lost uplink, and packets with an unresolved next hop go to the kernel instead of being dropped. (#1003, #1004, #1101)
• Spread service endpoints (opt-in). (#1092, #1093, #1094)
• Persistent private service access. (#851, #990)
• Galactic Edge agent (new, opt-in). A new node agent and image with MASQUE-based edge connectivity and six new edge CRDs.
• Router and CNI hardening. Traffic policy survives a router restart, netlink calls retry, and the GoBGP API is served read-only for the CLI. (#1008, #1132, #1167)
• Images and logging. Go images build from scratch, and every binary logs JSON at info. (#969, #1155)

Important

Upgrade in this order: CRDs, then galactic-router, then every gateway in a cell with backendHealth: true, and only then enable FailClosed services. galactic-cni needs a 256Mi memory limit on large nodes; production already has it.