feat(ingress): observe upstream network readiness

[jianpingpei]

Summary

• Observe physical TCP connection attempts made by the Ingress HTTP transport and WebSocket dialer without changing request routing or failure handling.
• Classify connection outcomes and aggregate a bounded, fixed-window shadow assessment using attempt, host-diversity, signal-host, and failure-ratio thresholds.
• Expose the latest completed assessment at /status.ok/network-readiness and publish low-cardinality OpenTelemetry connection and readiness metrics.
• Keep /status.ok, existing readiness probes, and Fleets route invalidation behavior unchanged. Invalid optional configuration disables observation instead of stopping the data plane.
• Document the endpoint, configuration, host-level target semantics, HTTP proxy first-hop behavior, and metrics.

This is the reusable community implementation. It intentionally contains no Aone-specific routing, Taskline/Fiber/Redis lookup, internal endpoint, or internal telemetry attributes.

Testing

• Not run (explain why)
• Unit tests
• Integration tests
• e2e / manual verification

Commands run:

• go test -count=10 ./pkg/proxy/connectivity
• go test -count=1 ./...
• go test -race ./pkg/proxy/connectivity ./pkg/proxy ./pkg/telemetry
• go vet ./...
• go build ./...
• go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 run -v --new-from-rev=origin/main ./...
• pnpm docs:build
• Ingress gateway Kubernetes mini E2E on an isolated Kind v1.27.3 cluster: 16 passed, 6 skipped
• Deployed endpoint smoke test: /status.ok/network-readiness returned HTTP 200, Cache-Control: no-store, and OK

The E2E used images built from this commit for Server and Ingress, the existing Execd E2E image, and the chart-default released Egress v1.1.7. The six skipped cases are suite-gated network-policy, host-volume, and pause/resume scenarios.

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[Pangjiping]

LGTM