[P5] Client sidecar: kernel and userspace paths as a native sidecar

[jacaudi]

Context

The injected client must be a native sidecar (restartPolicy: Always on an init container), not a plain init container.

An init container that exits cannot hold a userspace tunnel. With the kernel module, an interface created in the shared pod netns survives the container exiting — but wireguard-go is a process, and the interface dies with it. Since userspace fallback is a headline feature of this operator, a plain init container would silently produce a dead tunnel on any node without the kernel module.

Native sidecars also give ordering ahead of app containers — which is what closes the startup race where app containers begin before the tunnel is up and leak in the meantime.

Scope

Build the client sidecar supporting both the kernel and userspace paths, with startup ordering that guarantees the tunnel precedes application traffic.

Acceptance criteria

• Works with the kernel module and with wireguard-go fallback
• App containers do not start before the tunnel is established
• Sidecar restart re-establishes the tunnel without restarting the pod
• Clean teardown on pod termination

Depends on #17 and #26. See docs/ROADMAP.md § Phase 5.8.