Reconcile L7 steering against the real port-mapper state

[kacy]

Summary

• add read-side port-mapper mapping inspection for the XDP destination map
• make L7 steering reconcile and readiness use the actual programmed VIP mappings instead of only the local shadow cache
• add regressions for stale shadow-cache drift and stale VIP mapping cleanup during sync

Validation

• zig fmt on touched files
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=/tmp/yoq-zig-global-cache ZIG_LOCAL_CACHE_DIR=/tmp/yoq-zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "syncIfEnabled removes stale actual VIP mappings before applying desired set"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=/tmp/yoq-zig-global-cache ZIG_LOCAL_CACHE_DIR=/tmp/yoq-zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "snapshot reads actual mappings instead of stale shadow cache"
• timeout 45 env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=/tmp/yoq-zig-global-cache ZIG_LOCAL_CACHE_DIR=/tmp/yoq-zig-local-cache zig build test -Doptimize=ReleaseSafe -- --test-filter "route handles /v1/status?mode=service_rollout GET"

All three targeted runs reached the explicit timeout without emitted failures.