Replace L2 broadcast with sync via CRD

[rkschamer]

Summary

#69 delivers ICMP 3/4 messages using UDP across L2 boundaries. This requires every node in the cluster have an open port (e.g. 4390). This PR is eliminating this drawback by using CRD/CRs to exchange the received ICMP 3/4 messages between nodes, and hence used the API server to exchange the information.

The PR also abstracts the used relay (udp or crd) so that different relays can be used, depending on the use case.

What changes

New Relay interface (internal/relay)

type Relay interface {
    Send(ctx context.Context, pkt RelayPacket) error
    Start(ctx context.Context, inject func(payload []byte) error) error
}

Send is called from the NFLOG hot path; Start runs the receive loop (manager.Runnable). Capture (NFLOG) and injection (TUN pmtud0) stay shared across backends.

Shared TUN injector

createTUN + configureTUNNetlink extracted from internal/receiver into internal/relay/tun_linux.go as an Injector. One owner of the TUN fd; avoids double-open and centralises the loop-prevention contract (! -i pmtud0).

UDP backend (refactor, identical behavior)

Existing UDP path moved under the Relay interface. All existing tests preserved.

CRD backend

• Resource: PMTUNodeRelay (namespaced, CRD generated by controller-gen from api/v1alpha1/pmtunoderelay_types.go).
• Object name: <srcNode>--<sha256(payload)[:8]> — deterministic; duplicate events collapse to one object (AlreadyExists is a no-op).
• Spec: sourceNode, payload (base64 raw ICMP), expiresAt (RFC 3339).
• Delivery: broadcast — every daemon pod injects; peers skip objects where sourceNode == own NODE_NAME.
• GC: delete-after-inject (happy path) + TTL sweep on --relay-gc-interval ticker (default 60 s). Any daemon pod sweeps any expired object — no leader election needed.
• RBAC: namespaced Role (create/get/list/watch/delete on pmtunoderelays), no ClusterRole.

Backend selection

--relay-backend=udp|crd, default crd. --replication-port is rejected at startup if backend is not udp.

Why namespaced and broadcast

• Namespaced over cluster-scoped: least privilege; Role instead of ClusterRole; scoped list/watch/GC.
• Broadcast over targeted: util.CalcSrcDst yields the inner sender IP — a pod IP in Calico BGP clusters, not a node IP. Reverse lookup to a node would require a pod→node watch. Broadcast mirrors proven UDP semantics; PMTU events are rare (cold paths), so targeting is a premature optimisation.

Testing

Concern	Unit	Kind	E2E
Relay interface contract	✅	—	—
UDP backend (unchanged)	✅	✅	✅
CRD create/watch/inject/delete	✅ (envtest)	✅	✅
CRD GC of expired objects	✅	✅	—
Kernel PMTU cache update	—	✅	✅
Loop prevention (! -i pmtud0)	—	✅	✅

Non-Goals

• Running multiple backends simultaneously.
• Targeted CRD delivery / pod→node resolution (deferred).
• Helm chart changes (separate repo, follow-up).
• IPv6 or encryption changes.