docs+fixes(cni): finish the CNI plugin-chain split — docs, containerlab, dead code

[privateip]

Stack (merge bottom to top):

• refactor(cni): split galactic-cni into veth/tap master plugins #303 refactor(cni): split galactic-cni into veth/tap master plugins
• refactor(cni): extract galactic-ipam as a real delegated CNI IPAM plugin #304 refactor(cni): extract galactic-ipam as a real delegated CNI IPAM plugin
• refactor(cni): extract galactic-bgp as its own CNI chain plugin #305 refactor(cni): extract galactic-bgp as its own CNI chain plugin
• refactor(cni): extract galactic-route as its own CNI chain plugin #306 refactor(cni): extract galactic-route as its own CNI chain plugin
• docs+fixes(cni): finish the CNI plugin-chain split — docs, containerlab, dead code #307 docs+fixes(cni): finish the CNI plugin-chain split - docs, containerlab, dead code (this PR)

---

Summary

Fifth and final branch in the CNI plugin-chain split stack (based on #306). Docs, containerlab fixtures, and leftover dead code brought up to date with the 5-binary chain steps 0-3 built. No new runtime behavior beyond the fixes below.

installer.Bootstrap's binary-copy list already covers all five chain binaries (added incrementally per step) — nothing left to do there. Confirmed the static host-level conflist only ever carries node-level settings, never per-attachment fields, so its shape needs no change.

Docs rewritten

• docs/cni-cmd-sequence.md — all 3 diagrams rewritten with per-binary lifelines. Also fixes a pre-existing staleness: the diagrams showed a kernel seg6local route install, which the 2026-08-02 eBPF uSID datapath cutover had already replaced with vrf_table/locator_table/function_table map registration.
• docs/cni/configuration.md — full rewrite: chain/conflist structure, per-binary field tables, all 7 example configs as multi-plugin conflists. Corrected two inaccuracies: IPAM.Routes/Addresses are declared but never read by any allocation path; pool IPAM's DEL no longer reads a BGPAdvertisement CRD annotation (superseded by on-disk marker files).
• docs/agents/ARCHITECTURE.md — repo layout, components, entry points, config, module/package reference, key design decisions, testing, known constraints all updated. Same eBPF-cutover fix as the sequence doc. Added Known Constraints notes for two coverage gaps: e2e doesn't exercise galactic-route/galactic-bgp (pre-existing, unchanged by the split), and vmtap-cni (unrelated binary) has its own doc.

Real regression found and fixed: containerlab NAD fixtures

All 11 NAD YAML files under deploy/containerlab/ still used the pre-split single-plugin shape — no "ipam" block, no "plugins" chain array. Left as-is, every attachment would ADD successfully but silently allocate no IPAM address (top-level fields are unknown JSON to the new PluginConf) and never get BGP-advertised (no galactic-bgp invocation). Rewrote all 11 as plugins: [galactic-cni, galactic-bgp] conflists with addressing moved into an explicit ipam block. deploy/containerlab/docs/tenants.md's narrative updated to match.

e2e test fix

TestCNITapInterface invoked /galactic-cni directly with interface_type: tap and a bogus srv6_locator field — both removed in step 0, so it's been exercising nothing since. Fixed to invoke /galactic-tap-cni with the explicit-contract ipam shape and CNI_PATH=/ (where the image actually places every binary). Removed the eBPF-control-daemon startup this test no longer needs — eBPF registration is galactic-bgp's job now, which this test doesn't invoke (verifying that end-to-end needs a BGPRouter fixture, flagged in Known Constraints, not attempted here — no regression versus the monolithic predecessor's own coverage).

Dead code removed

• cmd/galactic-cni/main.go: deleted the stdin-peek-and-repipe dance and isTapMode() — unreachable once galactic-tap-cni became its own binary. cmd/galactic-tap-cni/main.go's copy-pasted version simplified too (it already set CNI_NETNS_OVERRIDE unconditionally; the buffering around it inspected nothing).
• internal/config/cni.go: removed GALACTIC_CNI_ENABLE_LOCAL_IPAM/CNIGetEnableLocalIPAM() — step 1 introduced the successor but never removed the predecessor; zero production callers remained.
• Doc comments in internal/plumbing/ebpf/doc.go, usidmap/vrf.go, internal/plumbing/srv6/usid.go, internal/gc/gc.go still pointing at the deleted internal/cni/bgp.go — updated to internal/cnibgp/bgp.go.

Verification

• task lint ✅ task build (all 8 binaries) ✅ task test:unit ✅
• task test:e2e not run, same caveat as every prior PR in this stack.

🤖 Generated with Claude Code

[mattdjenkinson]

Reviewed this one, the last in the stack. Deleting the isTapMode/CNI_NETNS_OVERRIDE bypass here is the right move, that's the exact dead code I flagged back on #303, but removing it changes the failure mode rather than closing it cleanly, and it's worth a look before merge.

cmd/galactic-cni/main.go:108: the vendored CNI skel library runs funcs.Add to completion before it ever checks CNI_NETNS_OVERRIDE or same-netns, that check only fires after cmdAdd returns. And internal/cni/ops_add.go's deferred cleanup only runs when err is non-nil, never on success. So if a tap-shaped or misrouted config still reaches the now veth-only galactic-cni binary running in host netns (say, a stray interface_type: "tap" field, which json.Unmarshal now silently ignores since PluginConf has no such field), cmdAdd runs all the way through, creates a VRF, a veth pair, a host route, and a NAD annotation patch, returns nil, and only then does skel's post-hoc same-netns check reject the ADD from the runtime's point of view. Nothing rolls any of that back, so every retry leaks more. NAD generation itself lives in an external operator outside this repo, so there's no way to fully rule out a caller like this still existing somewhere mid-migration across the stack.

A few smaller things. The 11 rewritten NAD YAML fixtures under deploy/containerlab/resources/tenants/** are hand-duplicated near-identical copies, only the VPC/attachment IDs and subnet CIDRs differ, rather than generated off the Kustomize base/overlay mechanism the same tree already uses elsewhere. That's the same failure mode that produced the bug this PR fixes in the first place: the earlier config-shape change had to be hand-propagated across 11 files and drifted before anyone noticed. Nothing here stops that from happening again on the next shape change.

cmd/galactic-cni/main.go:100 has a stale comment left over from code this PR deleted. It still says "...both skel's blocking stdin read and the io.ReadAll below would hang forever," but the io.ReadAll(os.Stdin) call it's referring to, along with the io import, is gone. Not a runtime issue, just misleading documentation sitting in the exact function this PR touches.

And docs/agents/ARCHITECTURE.md:195 has new and modified markdown tables that aren't column-aligned, which CONVENTIONS.md calls out explicitly as a rule for every table in this repo's markdown files.

Everything else I checked came back clean: the CNIGetEnableLocalIPAM/isTapMode removal itself, the e2e binary path fixes, the comment-only fixes elsewhere, NAD field names and CIDR correctness, and import/naming/error-handling conventions, all verified against build, vet, tests, and the actual code.

The resource-leak-on-retry issue is the one worth taking seriously, since it's a real gap the stack leaves open even though the change that surfaces it is the correct one to make.