Promote gateway real-internet mode & service_mirrors to experimental

[aidankhogg]

Motivation

• The gateway nftables policies and mirrored-mode operator output are now wired, so gateway_portal.real_internet.mode and gateway_portal.real_internet.service_mirrors should be represented as experimental rather than unsupported in the feature-state registry and docs.
• Tests and CLI validation must reflect that mirrored mode validates with a warning instead of failing alpha validation, while truly unsupported flags remain CI-failing.

Description

• Update feature-state registry in netengine/spec/feature_state.py to mark gateway_portal.real_internet.mode and gateway_portal.real_internet.service_mirrors as experimental and add explanatory caveats.
• Update documentation rows in docs/spec-alpha-support.md and docs/support-matrix.md to document the promoted experimental state and caveats about remaining real-host integration and DNS aliasing.
• Adjust CLI/tests in tests/test_cli.py so a spec with gateway_portal.real_internet.mode: mirrored validates successfully with --explain (shows a warning) and change the JSON CI-failure test to target upstream_resolver_enabled which remains unsupported.
• Adjust spec parsing test in tests/test_spec_parsing.py to assert the loader logs an experimental warning for mirrored gateway mode instead of raising SpecLoadError.

Testing

• Ran poetry run pytest tests/test_spec_parsing.py tests/test_cli.py tests/test_gateway_portal.py tests/test_feature_states.py and those targeted tests passed.
• Ran the full suite with poetry run pytest; the full run completed but showed 2 unrelated integration failures (TestFullMVPLifecycle.test_full_mvp_lifecycle returned 401 for reload and TestHealthRoute.test_health_does_not_leak_last_error_detail exposed last_error) that pre-existed this change.
• No new regressions observed in gateway rule generation or unit tests covering gateway portal behavior.

---

Codex Task