Add a dormant disposable Cilium traffic proof workflow #4396

🤖 Generated by the Agentic Engineer

Policy changes need traffic evidence before rollout. Add a manually dispatched, dormant verification workflow that tests an exact reviewed candidate in a disposable cluster, preserving DNS and admitted traffic while proving denied traffic cannot pass.

Part of #3501. This delivery provides the verification capability; the parent remains open for the real proof, staged rollout and template parity.

Acceptance criteria:

• Runs only from an explicitly selected main revision and verifies the exact trusted candidate PR revision; candidate files are data, never executable workflow code.
• Uses read-only repository access and no production credentials or provider resources.
• Requires explicit confirmation, remains dormant by default, and cleans up only its owned disposable cluster on success, failure or cancellation.
• Binds positive and negative traffic results to healthy, stable probe identities and records policy validity plus a finite proof receipt.
• Offline regression tests reject incomplete evidence, changed identities, extra policy rules and false denials; CI validates the scripts and workflow without starting a cluster.
• Documents the separate approval and runtime evidence required before the parent policy change can merge.