M6: anycast — pod lo + Ready-gated /128/32 + BIRD export

CNI ADD now adds anycast IPs to the pod's lo interface (NOT eth0 — design
doc rationale: avoid NDP/ARP DAD conflicts when N replicas share an IP).
Allocation persists the anycast list.

AnycastReconciler:
  desired = { ip → flock<8hex> } from
            committed allocations × pod.Status.PodReady=True
  diff against advertised, install/remove host /128 (v6) or /32 (v4)
  re-render bird.conf with the active set

Triggers: 2s tick, AfterCommit (per ADD/DEL), Pod informer Ready
transitions (PodCache.OnReadyChange callback).

The bird template already supported Anycast6/Anycast4 via the export
filter — this turn finally drives those slices from runtime.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/agent/anycast_stub.go

@@ -0,0 +1,19 @@
+//go:build !linux
+
+package agent
+
+import (
+	"context"
+	"log/slog"
+)
+
+// AnycastReconciler is a no-op on non-Linux platforms (lets the package
+// compile on developer machines for unit tests).
+type AnycastReconciler struct{}
+
+func NewAnycastReconciler(_ string, _ *Store, _ *PodCache, _ *NodeConfigCache, _ *BirdManager, _ string, _ *slog.Logger) *AnycastReconciler {
+	return &AnycastReconciler{}
+}
+
+func (r *AnycastReconciler) Trigger()                    {}
+func (r *AnycastReconciler) Run(_ context.Context)       {}