ci: add a dual-stack kind e2e job

[Yuan Gao (ygao-g)]

Part of #246. Nothing in CI runs a cluster carrying both address families, so two things go unexercised: code that reads one address where there are two, and IPv4 continuing to work once IPv6 does. Neither single-family lane can see either, because on each of them the one address present is the right one. This job builds a dual-stack kind cluster and asserts it really has both families before installing anything — a lane that quietly became single-stack would otherwise read as a second IPv4 lane. It runs the networking suite on both sandbox classes, which is where every test that can tell the families apart lives, and it gates nothing. Counting passes is not enough: those tests skip rather than fail when an address is missing, so the job names them and treats present-and-skipped as an error, per class.

It does not run on every pull request — the paths that could break it, nightly on main, and dispatch with a list of pull requests to merge onto main first. The changes that make IPv6 work do nothing apart, so only a stack of them shows the feature working; 911 938 1083 is the list that currently passes with no skips, and the stack lives only for the length of the run. A green run is about ten minutes. A paths filter is evaluated before the job is reached, so an opt-in label cannot sit beside one — dispatch is the escape hatch, and no new label is needed.

🤖 Generated with Claude Code

[Yuan Gao (ygao-g)]

Pushed the micro-VM half. The job now enables KVM, asserts the node really got
/dev/kvm and the ate.dev/sandboxClass=microvm label, deploys the micro-VM
counter and egress demos, and replays both suites under E2E_SANDBOX_CLASS=microvm.

Without it a dual-stack lane cannot tell a working micro-VM guest from one that
never got an IPv6 address. Both guards widened over the new logs, and the
family-critical skip check now runs per lane.