control: converge storage-guest egress to the ADR-0021 gateway-IP attach; remove the shared-mount-facing shim

[Yambr]

The live storage chain currently reaches the egress edge via an INTERIM shim in ocu-control: a storage-scoped guest joins a shared ocu-mount-facing docker network where the edge is multi-homed at a static IP, plus a static ExtraHosts edge:<ip> entry (control Provider.egressNetwork + EdgeHost, flags -egress-network / -edge-host; fleet compose ocu-mount-facing network). This DEVIATES from ADR-0021 (host-side L3 egress attach seam), which keeps every session on its per-session Internal: true bridge and reaches the edge via a host-root-netns net.Listen bound on the per-session bridge gateway IP — no shared network, structural (kernel-enforced) cross-session isolation rather than a policy filter.

The shim exists only because a gVisor (runsc) guest cannot reach Docker embedded DNS at 127.0.0.11, so the edge name would not resolve. That is a DNS symptom, not an L3 problem: the ADR-0021 attach works under gVisor when the guest dials the literal per-session gateway IP (the Sentry Netstack delivers a gateway-IP frame to the host stack as local input, not FORWARD, so Internal: true never blocks it; the DNS redirect is a container-netns NAT rule Netstack never traverses). This is now recorded as a Consequence in ADR-0021.

Convergence work (control):

• Implement the ADR-0021 EgressAttach seam: host-root-netns listener on the per-session bridge gateway IP, Attach on Create / Detach on teardown.
• Remove the shim: Provider.egressNetwork + EdgeHost, the -egress-network / -edge-host flags, the storage-guest join of the shared network, and the ExtraHosts edge:<ip> entry. The storage guest stays on its per-session Internal: true bridge.
• The guest resolves edge to its per-session gateway IP (a per-session ExtraHosts edge:<session-gateway-IP> keeps the name for TLS SAN verification), never a shared IP.
• Fleet compose: drop the ocu-mount-facing shared network for the guest; the edge terminates N per-session gateway IPs (edge-side termination is component-06 / ADR-0021 stand-in replacement).

Acceptance criteria:

• The shim symbols (egressNetwork, EdgeHost, -egress-network, -edge-host, shared-network join) are gone from control.
• Keystone: an Internal: true per-session bridge with a host-netns listener on its gateway IP accepts a runsc guest dialing that literal IP (proven live: a runsc guest on an Internal bridge reached a host-netns listener on the gateway IP; the connection was accepted).
• Negative: a runsc guest cannot reach a SIBLING session's bridge/guest (cross-session isolation is structural, not a DOCKER-USER policy filter).

Sequencing: the shim is the only proven-live egress path today and is honestly labeled as an ADR-0021 deviation in the code; converge AFTER the July-7 demo, not before (ripping out the working path to land an unimplemented seam days before the deadline is the destabilizing move).