feat(cilium): activate staged homogeneous device selection #2792

🤖 Generated by the Agentic Engineer

Part of #2610 and #2029.

Problem

The homogeneous Cilium device component is validated and staged, but production still references only the private-NIC component. That prevents the public default-route interfaces from receiving the eBPF programs required by the later masquerade and bandwidth-manager work.

Proposed direction

Activate the existing homogeneous-device component after the private-NIC component. Keep its OnDelete update strategy so the merge stages configuration without automatically restarting the fleet, and pin the resulting production render in CI.

Acceptance criteria

• The production overlay references homogeneous-devices after private-nic-devices.
• The rendered Cilium HelmRelease selects en+ eth+ and no longer resolves to the private-only device list.
• The rendered rollout strategy is OnDelete, so node replacement remains operator-stepped.
• WireGuard and the existing production encryption settings remain unchanged.
• CI executes a fail-closed render contract for the activation and merge order.

The parent remains open for the post-merge node-by-node rollout, live verification, soak, and later removal of the temporary OnDelete override.

Rough size: S.