Harden L7 steering readiness and VIP cutover gating

[kacy]

Summary

• make steering verification deterministic in tests and surface steering readiness in route and service APIs
• add rollout steering summaries for blocked vs drifted services
• gate VIP cutover readiness on steering preflight for HTTP-proxy services
• update the Phase 6 service discovery plan to match the implementation on main

Commits

• cb8903e Make steering mapping tests deterministic
• 80d9add Update Phase 6 status in service discovery plan
• fda37c3 Surface steering readiness in route degradation
• 34a877a Summarize steering drift in rollout status
• 844d8d9 Expose steering state in service detail
• 189c4cf Gate VIP cutover on steering preflight

Validation

• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "syncIfEnabled programs desired VIP mappings"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "listener state changes resync steering"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "materialized routes mark steering as degraded when VIP cutover is enabled"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "route handles /v1/status?mode=service_rollout GET"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "handleMetricsPrometheus exposes service rollout metrics"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "route handles GET /v1/services"