test(glb): harden provider withdrawal qualification

[nerdalert]

Summary

Hardens the GLB and no-ingress qualifications so provider withdrawal is evaluated against the exact backend candidate and only after the updated overlay revision is actually being served.

• Wait for the withdrawn candidate to disappear from every relevant edge overlay.
• Require Praxis to accept and serve that exact revision in two stable observations without a pod replacement or restart.
• Prefer trusted backend attribution over the coarser provider-gateway identity.
• Give the secondary east backend a distinct identity so it cannot be confused with the withdrawn primary.
• Keep GTM/session-drain assertions out of workload-only mode, which has no global ingress path.
• Preload the restricted NetworkPolicy probe image before using imagePullPolicy: Never.
• Use unique sessions for post-withdrawal workload probes.

Why

The prior harness could report a drain failure after Grid had correctly removed and published the withdrawn candidate. It used a site-level gateway header, so a still-eligible sibling candidate behind the east provider gateway looked identical to the withdrawn primary. The no-ingress path also ran a GTM-oriented session assertion even though that topology intentionally has no GTM.

This change preserves the routing and security assertions while making them correspond to the topology's actual contract.

Validation

Static validation passed:

• Workspace formatting and Clippy.
• Workspace tests and 530 xtask tests.
• make test, make doc, and make lint.
• git diff --check.
• Forge configuration validation.

Fresh Kind validation passed:

• Full GLB qualification: withdrawal serving gate, exact secondary attribution, session behavior, restoration, security checks, restart recovery, and soak.
• Full no-ingress qualification: serving gate, direct workload fallback to west, restoration, and NetworkPolicy controls.
• Automatic cleanup completed; no run-owned Kind clusters or qualification processes remain.

Evidence was kept outside the commit. No Grid production routing code or AI/Praxis source was changed.