docs(guides): prepare provider network deployment acceptance

[mapyr]

Why

Refs #471. Operator Audit and opt-in ingress fixes are now merged and released, but CI packet evidence does not establish enforcement on a target deployment. Provide a reviewable acceptance procedure with explicit unexecuted results and rollback.

How tested

• Relative links/anchors, CLI citations and Kubernetes manifest validation passed.
• Source identifier and freshness validators passed against a fresh core main checkout.
• Reviewed procedure against released operator v0.17.30: TCP/8080 ingress peer, annotations, opt-in defaults and Audit/default-Allow semantics.
• No cluster changes or deployment probes were run. Every result row remains NOT RUN.

What

• Add a deployment record, ingress source matrix, Audit/Enforce transitions, L7 decision checks and rollback.
• Qualify additive policies, remote providers, host/node traffic, established sessions and NodeLocal DNS.
• Link the procedure from the Kubernetes guide; leave accepted ADR bodies unchanged.

Risk and rollback

Documentation only. Probe execution requires approval for the named cluster and resources. Revert the documentation commit to roll back.

Agent metadata

• Single Conventional Commit scope: guides
• Single goal (no scope creep)
• LOC declared upfront: below 140 added lines
• Files in scope match the issue brief