feat: add sanitized MetalLB BGP edge

[systemdbrew]

Summary

Publish a sanitized reference implementation of the production KernelCafe MetalLB BGP design.

This replaces the generic L2Advertisement example with the routing model actually used by KernelCafe:

• MetalLB BGPPeer using private ASNs
• selected service VIPs advertised as /32 routes
• BGPAdvertisement scoped to the edge VIP pool
• 1s keepalive / 3s hold-time failure-detection model
• documentation explaining why BGP is used instead of extending the service VLAN onto Talos nodes
• explicit recommendation for upstream route filtering

Sanitization

Production addresses, node inventory, gateway identity, VIPs and router configuration are intentionally omitted. The public example uses documentation-only 10.10.x.x addresses and private ASNs.

Production source

The architecture is derived from the private production infrastructure/networking/metallb implementation rather than being a hypothetical BGP example.

Validation

Existing repository CI will YAML-lint and Kustomize-render the MetalLB resources. Gitleaks will continue to scan the branch/history.