fix: neutralize persisted inverted TPP on the coraza edge path (#252 follow-up)

[ecv]

What

Follow-up to #252. Makes the controller genuinely withhold an already-persisted inverted-paranoia TrafficProtectionPolicy (blocking > detection) from the coraza edge data plane, so benign traffic serves 200 instead of the CRS 901500 fail-closed 500. Also promotes the neutralization e2e (split out of #272) into the gating suite.

Root cause

#252 set Accepted=False/Invalid and skipped attachment — but only on the controller's EnvoyPatchPolicy path (internal/controller/trafficprotectionpolicy_controller.go). The live datum-downstream-gateway enforces coraza through the extension server, which builds per-route directives in a completely separate path (internal/extensionserver/cache/index.go → computeCorazaDirectives) that #252 never touched. So a grandfathered inverted policy still emitted its coraza SecRules to the edge and 500'd benign traffic — confirmed in prod (kev-httpbin ~53k 500s/24h, pcep-lol-hnqr6o ~17k/24h). See #273.

Fix

• Add a shared predicate TrafficProtectionPolicySpec.InvertedParanoiaLevels() in api/v1alpha, and route both the controller resolve-error guard (fix: flag inverted TrafficProtectionPolicy paranoia levels via status condition #252's behavior, unchanged) and the extension-server emission through it — the inverted check is no longer duplicated.
• computeCorazaDirectives returns nil for an inverted policy, so ApplyTPPRouteConfig skips the route (its len(governing.Directives) == 0 guard) and the golang coraza filter stays disabled for that route. Benign traffic is unaffected.
• fix: flag inverted TrafficProtectionPolicy paranoia levels via status condition #252's Accepted=False/Invalid status behavior is preserved.

Tests

• Go unit tests (table-driven, matching existing style):
  • api/v1alpha: InvertedParanoiaLevels — inverted reported, equal/higher-detection/no-ruleset not.
  • internal/extensionserver/cache: emission-layer — inverted → no directives (index build + computeCorazaDirectives), valid and equal levels → emitted.
• go test ./... (non-e2e), go vet, make generate (no diff), make lint (0 issues) all green locally.

e2e

Promoted trafficprotectionpolicy-neutralize-inverted into the gating test/e2e/ suite (dropped the now-empty test-e2e-nonblocking target) so this PR's own E2E check validates the fix end-to-end in the downstream-WAF kind env (#268). The benign GET / → 200 assertion now describes neutralized behavior rather than an expected-red defect. Kind e2e can only be confirmed by CI — if the E2E check reds, the move is trivially revertible back to quarantine.

Notes

• Done on this branch:
  • Controller fix: withhold an inverted policy's coraza config from the downstream extension-server emission (not just the status condition).
  • Flip the test into the gating suite.
• This is a user-directed exception to the TrafficProtectionPolicy Enforce mode: 500 with truncated/empty body on all traffic #242 arc-freeze (edge 500s on benign traffic in prod), not a freeze blocker.

Fixes #273. Refs #252, #242, #268, datum-cloud/infra#3408.