perf(networking): make Cilium ENI native routing the DEFAULT CNI (post-stabilization flip)

[rustyrazorblade]

Goal

Flip the default CNI from Flannel to Cilium ENI native routing once it is proven stable on live multi-AZ clusters.

Context

#805 lands Cilium ENI IPAM native routing as a selectable, opt-in datapath via --cni=cilium (the default stays flannel in that patch, deliberately, to de-risk the rollout). All the hard parts — the ENI --set flags, the Hubble brace-expansion fix, the worker-node IMDS hop-limit fix, the CniMode enum, and the live cross-AZ validation matrix — ship in #805.

This issue is the small, deliberate follow-up: change the default InitConfig.cni from CniMode.Flannel to CniMode.Cilium (and the --cni option default), after #805's native routing has been exercised on real clusters and we trust it.

Work

• Flip the default value of --cni / InitConfig.cni to cilium.
• Update the fromInit default test and any provisioning defaults.
• Update docs (the observability CLAUDE.md CNI line becomes unconditionally true).

Acceptance criteria

• WHEN a cluster is provisioned with no --cni, THEN it uses Cilium ENI native routing by default.
• WHEN --cni=flannel is passed, THEN Flannel is still selectable.

Notes

• Gated on perf(networking): make Cilium native routing (eBPF) the default — resolve the worker-bootstrap deadlock #805 landing and being validated live. Do not start until Cilium native routing is trusted.
• P2 stabilization follow-up; ephemeral clusters, no migration concern.