Phase 0: centralize legacy service discovery writes

[kacy]

Summary

• add a service_registry_bridge module that centralizes the current legacy DNS writes plus shadow reconciler events
• switch container networking and health checker paths to call the bridge instead of mutating DNS and shadow state separately
• add bridge tests and register the new module in the main test root

Commits

• fd2979a Add service registry bridge module
• c58d975 Route service discovery writers through bridge

Verification

• zig fmt on touched files
• zig build test -- --test-filter "container bridge preserves legacy DNS and shadow events" timed out after 30 seconds without emitted failures