Complete Phase 3 stable VIP DNS and L4 load balancing

[kacy]

Summary

• raise the DNS and load-balancer BPF capacities for stable service VIPs and 64 backends per service
• make the authoritative reconciler program stable VIP DNS answers while keeping the compatibility mirror on backend IPs
• preserve VIP visibility with zero eligible backends and fail fast at L4 instead of silently black-holing traffic
• mark backend-capacity overflow immediately and cover the new VIP path with reconciler and registry tests

Verification

• zig fmt on touched files
• bounded zig build test run timed out after 30 seconds with no emitted failures
• targeted zig build test runs were used while iterating on the VIP DNS and overflow paths