fix(dependencies): address PR review findings

- Read the MetalLB speaker tag check from the managed host with slurp
  instead of a controller-side file lookup, and match the full image
  reference
- Restore the tigera-operator namespace on the Calico operator Deployment
  wait while keeping the managed CRD waits cluster-scoped
- Make Molecule verify inputs durable and scenario-specific via a
  per-scenario verify-vars.yml, driven by explicit verify_cni/verify_lb
  values instead of non-persisted converge facts
- Rename the kube-vip multi-peer BGP env var from bgppeers to bgp_peers
  and vip_cidr to vip_subnet so v1.2.2 actually reads them
- Map the legacy Cilium routed mode to tunnel and stop passing the alias
  directly to the chart
- Use return-code based failed_when on apply and preflight commands so
  non-error failures are no longer treated as success
- Clarify the sequential K3s upgrade path and backups in the README
- Add kube-vip and MetalLB regression tests and a Cilium mode mapping unit

README.md

@@ -98,9 +98,12 @@ They are not a supported direct in-place upgrade path for an existing cluster.
 K3s, Calico, and Cilium each require staged upgrades for long-lived clusters.
 
 - **K3s**: do not jump an embedded-etcd cluster straight to Kubernetes 1.36.
-  First run a K3s patch that contains etcd 3.5.26 (for example `v1.33.7+k3s3`
-  or newer in the 1.33 line), then advance one Kubernetes minor version at a
-  time. Upgrade servers one at a time before agents. See
+  Upgrade one Kubernetes minor version at a time. From the sample default
+  (`v1.30.2+k3s2`) the sequence is: the latest supported 1.30 patch, then 1.31,
+  1.32, a 1.33 patch that contains etcd 3.5.26 (for example `v1.33.7+k3s3`),
+  then 1.34, 1.35, and finally 1.36. Upgrade servers one at a time before
+  agents. Take backups and confirm cluster health at each step; this playbook
+  does not automate the upgrade, so those remain manual operational steps. See
   [K3s manual upgrades](https://docs.k3s.io/upgrades/manual) and the
   [v1.34 release notes](https://docs.k3s.io/release-notes/v1.34.X).
 - **Cilium**: upstream supports only consecutive minor upgrades. Update to the