Pin the MAC-first zone arm with a host-route nexthop scenario

[arasHi87]

Closes

Refs #302 — stays open for the live scenariotest run on staging. The full rationale now lives there rather than in the source comment. Parent story #201.

What & why

twovms-same-tenant can't prove the hybrid lookup's MAC-first arm ever runs: its destination IP is the peer's IP, both in sub-T1, so the MAC arm and the trie arm both answer same_tenant and it passes whichever executed.

host-route-nexthop makes them disagree — a host route steers vm-a at vm-nh (L2-adjacent, same tenant) toward 10.0.82.0/24, a prefix absent from the topology. MAC arm says same_tenant; trie arm says external (catchall). Asserting same_tenant/tx grew while external stayed flat pins which ran, and the external bound doubles as a check that AddRouteStep took.

Deliberate omissions: an in-guest route stands in for a Neutron host_routes entry (byte-identical frames — staging DHCP option 121 would test Neutron's DHCP agent, not the classifier); rx isn't asserted (there the trie resolves vm-a's source IP inside sub-T1 and also answers same_tenant, so it'd prove delivery, not the arm).

Test plan

• Unit — task test
• Integration — task test-integration (Docker, BPF caps)
• Bench-gate — task bench-gate (hot-path changes only)
• Scenario — scenariotest run <name>
• Manual e2e on a live cluster

task test green, go vet ./cmd/... clean, internal/docs (chapter-citation guard) passes, scenariotest list shows it.

Live validation (optional)

Not yet run — live-tier test, proves nothing until scenariotest run host-route-nexthop passes on dev-cmp or c36. Only real risk is ARP: vm-a must resolve .50 to vm-nh's MAC. Downstream delivery is irrelevant — the assert is on vm-a's own tap and the drive is a sized-ping push tolerating no replies.

Scope / deliberately not touched

No internal/neutron unit test: neutron.Subnet (types.go:39) has no HostRoutes field, so testing "host_routes is inert" would mean adding the field purely to assert we ignore it.

Notes

Catalog-only — one scenario file plus one registry entry, no production code, no contract in docs/architecture/contracts.md touched.

DoD

• Linked issue's DoD met, incl. Handbook knowledge update — bigstack-oss/bigstack-handbook#289