benchmarking: add the egress-tunnels workload - #2716

Part of #2715

First of the PRs that measure how many CONNECT tunnels the egress gateway can hold and what each costs. This PR adds benchmark-egress, one binary with two subcommands: actor, which runs inside each Actor and holds one tunnel per endpoint through the gateway, and target, the Deployment behind the endpoint Services. The driver, the deploy script and the orchestrator entry follow in later PRs.

Design and details: https://github.com/ygao-g/substrate/tree/egress-tunnels-workload/cmd/benchmarking/egress. The README there is the design doc: what the benchmark measures (tunnel, blended, settled), the topology, the traffic shape over a run, what the actor does and reports, what a run computes, and the decisions with the alternatives they displaced. More specifically,

• Pacing. The gateway's stream idle timeout is 5 minutes by default, so every tunnel has to stay busy. With C endpoints the actor runs one goroutine per endpoint: endpoint i opens i intervals after /start, then each is requested once per period of C × intervalMs.
• Report. The actor records its four latency distributions as OTel histograms on a private MeterProvider behind a manual reader in delta temporality, and serves them as window cuts: POST /collect?window=N answers the counters and the distributions since the previous cut, each distribution as the fields of an OTel histogram data point with the bounds in the payload, so the driver merges across actors with Point.Merge and refuses an image that buckets differently. The actor caches the last cut by id: a lost answer is asked for again and costs a retry, not a window; a skipped or older id is 409. GET /stats serves the cumulative counters for a driver's gates. POST /stop is the last cut.
• Target. One Deployment behind every endpoint Service, one backend port per Service. For HTTPS it serves a certificate from a throwaway CA name-constrained to the endpoint domain.

Overview of Commits.

1. the binary: Cobra root, no subcommands yet
2. the contract: the routes and the /start fields, the Stats counters, Point with Merge and Quantile, the shared bounds, the collect route and window id, protocol version 2
3. the name-constrained CA and certificate the target serves
4. the actor subcommand: the loop, the recorder, /stats, /collect with window ids, /stop, the protocol header, classify
5. the target subcommand
6. the README

Testing

Unit tests cover the window ids (first cut is 1, the last id answers again byte for byte, the next id cuts, anything else is 409 with the next id named), that a repeated /collect consumes nothing and the sample between two answers lands in the next window, the cut invariant under concurrent reads (each window's samples equal the growth of successes since the previous cut), that a /collect racing a /stop is never a 500, Merge refusing differing bounds by index, and the payload budget at C = 1024 (/stats under 1 KiB, a cut under 12 KiB).

Ran on GKE at 250 × 1000 and 1000 × 1000 HTTPS endpoints through one gateway replica, with the actor serving cuts: 0 errors and 0 redials in the settled window, every actor answering every round, 6.0 M settled requests at 10,070 req/s on 8.13 gateway cores at 1000 × 1000, and p99 within one bucket step of the earlier exposition-based run. The target served 1000 Services on the port range from one image.

Prepared with help from an AI coding agent; reviewed and verified by the author.