Make Envoy the default proxy and explore transparent L3/L4 interception

[ChrisJBurns]

Part of #5900. Future direction, gated on the earlier work proving out.

Goal

Two related forward steps once the Envoy backend is stable and dogfooded.

Tasks

• Flip the default from Squid to Envoy (after validation across platforms, incl. Docker Desktop's LinuxKit VM and Colima/Rancher).
• Transparent L3/L4 interception (design first). Non-cooperative traffic (workloads that ignore HTTP_PROXY) is currently contained only by the Internal: true network blackhole. An original_dst listener + iptables REDIRECT/TPROXY (installed by a privileged init container so the workload never holds NET_ADMIN) would make enforcement non-bypassable.
• Redirecting DNS (port 53) through the same interception path is the route to eliminating the dnsmasq container — folding DNS, egress, and ingress into the single Envoy instance.

Notes

Transparent interception needs its own docs/arch/ design and per-platform validation before any implementation. Retain the Internal: true blackhole as the fail-closed backstop in every phase.

[ChrisJBurns]

Splitting into two focused issues: one for making Envoy the default proxy, one for transparent L3/L4 interception.