docs+fixes(cni): finish the CNI plugin-chain split — docs, containerlab, dead code

[privateip]

Stack (merge bottom to top):

• refactor(cni): split galactic-cni into veth/tap master plugins #303 refactor(cni): split galactic-cni into veth/tap master plugins
• refactor(cni): extract galactic-ipam as a real delegated CNI IPAM plugin #304 refactor(cni): extract galactic-ipam as a real delegated CNI IPAM plugin
• refactor(cni): extract galactic-bgp as its own CNI chain plugin #305 refactor(cni): extract galactic-bgp as its own CNI chain plugin
• refactor(cni): extract galactic-route as its own CNI chain plugin #306 refactor(cni): extract galactic-route as its own CNI chain plugin
• docs+fixes(cni): finish the CNI plugin-chain split — docs, containerlab, dead code #307 docs+fixes(cni): finish the CNI plugin-chain split - docs, containerlab, dead code (this PR)

---

Summary

Fifth and final branch in the CNI plugin-chain split stack (based on #306). Docs, containerlab fixtures, and leftover dead code brought up to date with the 5-binary chain steps 0-3 built. No new runtime behavior beyond the fixes below.

installer.Bootstrap's binary-copy list already covers all five chain binaries (added incrementally per step) — nothing left to do there. Confirmed the static host-level conflist only ever carries node-level settings, never per-attachment fields, so its shape needs no change.

Docs rewritten

• docs/cni-cmd-sequence.md — all 3 diagrams rewritten with per-binary lifelines. Also fixes a pre-existing staleness: the diagrams showed a kernel seg6local route install, which the 2026-08-02 eBPF uSID datapath cutover had already replaced with vrf_table/locator_table/function_table map registration.
• docs/cni/configuration.md — full rewrite: chain/conflist structure, per-binary field tables, all 7 example configs as multi-plugin conflists. Corrected two inaccuracies: IPAM.Routes/Addresses are declared but never read by any allocation path; pool IPAM's DEL no longer reads a BGPAdvertisement CRD annotation (superseded by on-disk marker files).
• docs/agents/ARCHITECTURE.md — repo layout, components, entry points, config, module/package reference, key design decisions, testing, known constraints all updated. Same eBPF-cutover fix as the sequence doc. Added Known Constraints notes for two coverage gaps: e2e doesn't exercise galactic-route/galactic-bgp (pre-existing, unchanged by the split), and vmtap-cni (unrelated binary) has its own doc.

Real regression found and fixed: containerlab NAD fixtures

All 11 NAD YAML files under deploy/containerlab/ still used the pre-split single-plugin shape — no "ipam" block, no "plugins" chain array. Left as-is, every attachment would ADD successfully but silently allocate no IPAM address (top-level fields are unknown JSON to the new PluginConf) and never get BGP-advertised (no galactic-bgp invocation). Rewrote all 11 as plugins: [galactic-cni, galactic-bgp] conflists with addressing moved into an explicit ipam block. deploy/containerlab/docs/tenants.md's narrative updated to match.

e2e test fix

TestCNITapInterface invoked /galactic-cni directly with interface_type: tap and a bogus srv6_locator field — both removed in step 0, so it's been exercising nothing since. Fixed to invoke /galactic-tap-cni with the explicit-contract ipam shape and CNI_PATH=/ (where the image actually places every binary). Removed the eBPF-control-daemon startup this test no longer needs — eBPF registration is galactic-bgp's job now, which this test doesn't invoke (verifying that end-to-end needs a BGPRouter fixture, flagged in Known Constraints, not attempted here — no regression versus the monolithic predecessor's own coverage).

Dead code removed

• cmd/galactic-cni/main.go: deleted the stdin-peek-and-repipe dance and isTapMode() — unreachable once galactic-tap-cni became its own binary. cmd/galactic-tap-cni/main.go's copy-pasted version simplified too (it already set CNI_NETNS_OVERRIDE unconditionally; the buffering around it inspected nothing).
• internal/config/cni.go: removed GALACTIC_CNI_ENABLE_LOCAL_IPAM/CNIGetEnableLocalIPAM() — step 1 introduced the successor but never removed the predecessor; zero production callers remained.
• Doc comments in internal/plumbing/ebpf/doc.go, usidmap/vrf.go, internal/plumbing/srv6/usid.go, internal/gc/gc.go still pointing at the deleted internal/cni/bgp.go — updated to internal/cnibgp/bgp.go.

Verification

• task lint ✅ task build (all 8 binaries) ✅ task test:unit ✅
• task test:e2e not run, same caveat as every prior PR in this stack.

🤖 Generated with Claude Code