Use deployment configuration for the router status Service IP

[Robbie Cronin (robert-cronin)]

Fixes #1457

The shipped router's /statusz handler tries to read a Service that its ServiceAccount cannot access. Read optional ROUTER_SERVICE_IP deployment configuration instead, mapped from Kubernetes' ATENET_ROUTER_SERVICE_HOST, and install the Service before the Deployment. The handler no longer makes the synchronous Service API request; the existing EndpointSlice-only Role is sufficient.

Label the address as a container-start snapshot, independent of --namespace. Missing or invalid configuration displays Unavailable in HTML and an empty router_cluster_ip string in JSON. Service recreation can leave the snapshot stale until restart. Document these semantics and cover IPv4, IPv6, missing/invalid values, HTML/JSON output, namespace independence, and zero Kubernetes API actions.

Validation: make verify and the router packages under -race passed. A full local Envoy installation passed the gVisor and micro-VM E2E lanes, including the separate MITM trust and egress-networking runs for both runtimes. Live HTTP checks covered fresh full/raw installs, missing/disabled injection, an unrelated namespace, egress, and readiness; real ServiceAccount checks denied Service access while preserving EndpointSlice permissions. The Kind volume tests used the repository-supported hostpath CSI driver because this host lacks NFS support.

• Tests pass
• Appropriate changes to documentation are included in the PR

[Keith Mattix II (keithmattix)]

If we're assuming a static service name, why not use the ATENET_ROUTER_SERVICE_HOST env var that gets auto injected

[Robbie Cronin (robert-cronin)]

Switched this to ROUTER_SERVICE_IP, mapped from Kubernetes' ATENET_ROUTER_SERVICE_HOST, and removed the Service lookup and added RBAC grant. The manifest installs the Service first. /statusz labels the value as a container-start snapshot and shows Unavailable when injection is missing or invalid (an empty string in JSON); recreating the Service can leave it stale until restart.

Validated fresh full/raw installs, missing/disabled injection, namespace independence, egress, and readiness on Kind. make verify and both full Envoy gVisor/micro-VM E2E lanes passed, including the separate MITM trust and egress tests. Volume tests used hostpath CSI on the local cluster.