Phase 2: make the service reconciler authoritative

[kacy]

Summary

• make service_reconciler the authoritative writer for legacy DNS/BPF state and the service_names compatibility mirror when service_registry_reconciler is enabled
• have the bridge stop mutating legacy DNS directly in authoritative mode and emit intents into the reconciler instead
• add reconciler bootstrapping at server and local deploy startup so DNS and compatibility mirror state rebuild from the canonical registry on process start
• add specific dns.unregisterServiceEndpoint and store.removeServiceNamesByName helpers so reconciliation works per service instead of relying on container-global deletes

Commit

• b94f640 Make service reconciler authoritative for legacy DNS

Verification

• env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache timeout 30 zig build test -- --test-filter "authoritative bootstrap populates DNS and compatibility mirror|authoritative reconciler owns legacy DNS writes when enabled|container bridge preserves legacy DNS and shadow events|lookupClusterService resolves from service_names table|registerServiceName and lookupServiceNames round-trip|unregisterServiceName removes service binding" timed out after 30s with no emitted failures

Follow-up

• Phase 2 still needs periodic audits / resync and a richer degraded-status surface
• DNS is still returning backend IPs in this compatibility mode; VIP answers remain Phase 3 work