M6: anycast — pod lo + Ready-gated /128/32 + BIRD export

CNI ADD now adds anycast IPs to the pod's lo interface (NOT eth0 — design
doc rationale: avoid NDP/ARP DAD conflicts when N replicas share an IP).
Allocation persists the anycast list.

AnycastReconciler:
  desired = { ip → flock<8hex> } from
            committed allocations × pod.Status.PodReady=True
  diff against advertised, install/remove host /128 (v6) or /32 (v4)
  re-render bird.conf with the active set

Triggers: 2s tick, AfterCommit (per ADD/DEL), Pod informer Ready
transitions (PodCache.OnReadyChange callback).

The bird template already supported Anycast6/Anycast4 via the export
filter — this turn finally drives those slices from runtime.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/agent/podinfo.go

@@ -15,13 +15,28 @@ import (
 	"k8s.io/client-go/tools/cache"
 )
 
+// podReady returns true iff the Pod has a Ready=True condition. The
+// canonical readiness signal kubelet reports based on container readiness
+// probes — anycast advertisement and (future) NetworkPolicy hooks key off
+// this.
+func podReady(pod *corev1.Pod) bool {
+	for _, c := range pod.Status.Conditions {
+		if c.Type == corev1.PodReady {
+			return c.Status == corev1.ConditionTrue
+		}
+	}
+	return false
+}
+
 // PodCache exposes a Get(ns, name) lookup against a node-scoped Pod
 // informer. ADD/DEL handlers consult it to read annotations + labels for
-// IPAM and (later) NetworkPolicy.
+// IPAM and (later) NetworkPolicy. Callers can subscribe to Ready
+// transitions via OnReadyChange.
 type PodCache struct {
-	lister cache.GenericLister
-	logger *slog.Logger
-	store  cache.Store
+	logger          *slog.Logger
+	store           cache.Store
+	informer        cache.SharedIndexInformer
+	onReady         []func()
 }
 
 // StartPodInformer launches a Pod informer filtered to spec.nodeName ==
@@ -39,13 +54,53 @@ func StartPodInformer(ctx context.Context, cfg *rest.Config, node string, logger
 		informers.WithTweakListOptions(tweak))
 	inf := factory.Core().V1().Pods().Informer()
 
+	pc := &PodCache{store: inf.GetStore(), logger: logger, informer: inf}
+
+	_, _ = inf.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			if pod, ok := obj.(*corev1.Pod); ok && podReady(pod) {
+				pc.fireReady()
+			}
+		},
+		UpdateFunc: func(oldObj, newObj interface{}) {
+			oldP, _ := oldObj.(*corev1.Pod)
+			newP, _ := newObj.(*corev1.Pod)
+			if oldP == nil || newP == nil {
+				return
+			}
+			if podReady(oldP) != podReady(newP) {
+				pc.fireReady()
+			}
+		},
+		DeleteFunc: func(obj interface{}) {
+			pc.fireReady()
+		},
+	})
+
 	logger.Info("Pod informer starting", "node", node, "field_selector", "spec.nodeName="+node)
 	factory.Start(ctx.Done())
 	if !cache.WaitForCacheSync(ctx.Done(), inf.HasSynced) {
 		return nil, fmt.Errorf("pod informer cache failed to sync")
 	}
 	logger.Info("Pod informer synced", "node", node, "items", len(inf.GetStore().ListKeys()))
-	return &PodCache{store: inf.GetStore(), logger: logger}, nil
+	return pc, nil
+}
+
+// OnReadyChange registers a callback fired on every Pod readiness
+// transition observed by the informer (and on Add when the pod is already
+// Ready, and on Delete unconditionally). Used by the AnycastReconciler.
+//
+// Safe to call before Run; callbacks fire synchronously inside the
+// informer's event handler so they should be cheap (the AnycastReconciler
+// just sends to a coalescing channel).
+func (c *PodCache) OnReadyChange(f func()) {
+	c.onReady = append(c.onReady, f)
+}
+
+func (c *PodCache) fireReady() {
+	for _, f := range c.onReady {
+		f()
+	}
 }
 
 // Get looks up a Pod by namespace and name. Returns (nil, false) if absent.