Prevent IPv6 destinations from bypassing network policies

[JimBugwadia]

User outcome

A default-deny destination policy protects dual-stack workloads as well as IPv4-only workloads.

Current behavior

The network BPF filter passes non-IPv4 packets. IPv6 literals are rejected; protocol classification does not constrain destination identity.

Scope

• Add IPv6 destination parsing, map keys, enforcement and decision-aware observation.
• Preserve multi-policy deny/allow semantics and IPv4-mapped address normalization.
• Report unsupported kernel/platform combinations without claiming full coverage.

Acceptance

• A dual-stack workload reaches an allowed IPv6 destination and cannot reach a denied or omitted destination under default deny.
• IPv4 behavior remains correct; monitor mode never installs denies.
• Policy updates/deletes and mixed-family rules work; both allowed and denied observations carry the right family and decision.

Dependencies and boundaries

Child of #65. Coordinate map schema with the CIDR child; this is not blocked by DNS/TLS observation.

Validation and completion

• Table-driven tests pin the stated invariant, including invalid input and policy updates.
• For code changes: make build and make test; significant changes also require make kind-install and a targeted behavioral check. Pipeline, collector, evaluator, or reporter changes require make smoke-quickstart.
• Kernel changes use the pinned BPF builder, generated-artifact verification, verifier loading, and allowed/denied behavior tests on supported hook paths.
• Update DESIGN, development guidance where affected, and the RuntimePolicy reference and limits. Every rejected user rule must reach an operator log and policy condition; count every observation drop. Preserve the reporter redaction boundary.