Part of #246.
TestActorEgress fetched `http://example.com/`, so the test failed
whenever that host was unreachable rather than when egress broke.
GitHub-hosted runners also have no IPv6, so egress to an external domain
needs extra setup on an IPv6-only cluster.
The test now deploys its own testserver origin and fetches that. Since
an in-cluster origin would answer a pre-gateway masquerade just as
readily, the test asserts the atenet-egress access log recorded the
actor's CONNECT, and a subtest fetches by Service DNS name to keep
actor-side resolution covered. ServerPod gains `TargetPort` (defaulting
to `Port`) so the Service can publish 80 while the container binds an
unprivileged listener; the rendering is unit-tested without a cluster.
First of a series retiring the remaining example.com fetches.
Tested: presubmits on the fork.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Yuan Gao
7a3347390d