M6: anycast — pod lo + Ready-gated /128/32 + BIRD export

CNI ADD now adds anycast IPs to the pod's lo interface (NOT eth0 — design
doc rationale: avoid NDP/ARP DAD conflicts when N replicas share an IP).
Allocation persists the anycast list.

AnycastReconciler:
  desired = { ip → flock<8hex> } from
            committed allocations × pod.Status.PodReady=True
  diff against advertised, install/remove host /128 (v6) or /32 (v4)
  re-render bird.conf with the active set

Triggers: 2s tick, AfterCommit (per ADD/DEL), Pod informer Ready
transitions (PodCache.OnReadyChange callback).

The bird template already supported Anycast6/Anycast4 via the export
filter — this turn finally drives those slices from runtime.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/agent/handlers.go

@@ -78,6 +78,7 @@ func (h *PodHandler) Add(ctx context.Context, req flockcni.Request) (*current.Re
 		OwnerUID:    string(pod.UID),
 		IP6:         ipString(res.IP6),
 		IP4:         ipString(res.IP4),
+		Anycast:     anycastStrings(parsed.Anycast),
 		State:       StatePending,
 		AllocatedAt: time.Now().UTC(),
 	}
@@ -93,6 +94,7 @@ func (h *PodHandler) Add(ctx context.Context, req flockcni.Request) (*current.Re
 		HostIface:   HostIfaceName(req.ContainerID),
 		IP6:         res.IP6,
 		IP4:         res.IP4,
+		Anycast:     parsed.Anycast,
 	}
 	if err := h.SetupFunc(setup); err != nil {
 		// Roll forward: leave pending entry in place so startup GC can clean
@@ -172,3 +174,14 @@ func ipString(ip net.IP) string {
 	}
 	return canonical(ip)
 }
+
+func anycastStrings(ips []net.IP) []string {
+	if len(ips) == 0 {
+		return nil
+	}
+	out := make([]string, len(ips))
+	for i, ip := range ips {
+		out[i] = canonical(ip)
+	}
+	return out
+}