Keep Cilium on physical interfaces

[PragalvaXFREZ]

Summary

• restrict Cilium device selection to physical enp+ interfaces
• prevent NetBird wt0 from lowering the pod network MTU
• document the device-selection and verification contract

Root cause

NetBird added wt0 at MTU 1280. Cilium auto-detected that overlay as a datapath device and lowered cilium_host from MTU 1500 to 1280. Existing Cloudflare QUIC sessions survived until reconnect, after which new handshakes failed.

Validation

• rendered every chart-backed Argo CD Application
• confirmed the rendered Cilium ConfigMap sets devices: enp+
• kubeconform: 59 valid, 4 skipped, 0 invalid
• documentation contract passed
• git diff --check passed