fix(phase1): two execution-surfaced bugs bringing up k3s+Cilium

- ansible.cfg: stdout_callback 'yaml' (community.general.yaml) was REMOVED in
  ansible-core 2.20 -> use builtin default + result_format=yaml.
- cilium-values: egressGateway.enabled requires ipv4+eBPF masquerade or the
  agent fatals at startup ('egress gateway requires --enable-ipv4-masquerade
  and --enable-bpf-masquerade'). Add enableIPv4Masquerade + bpf.masquerade=true
  (also the correct pairing with kubeProxyReplacement; [parity] w/ platform/cilium).

Verified live: 3/3 nodes Ready, embedded-etcd HA, Cilium status OK, CoreDNS up.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

infra/ansible/ansible.cfg

@@ -3,7 +3,9 @@ inventory = inventory/hosts.ini
 roles_path = roles
 host_key_checking = False
 retry_files_enabled = False
-stdout_callback = yaml
+# ansible-core 2.20 removed community.general.yaml; use the builtin default with YAML result format.
+stdout_callback = default
+result_format = yaml
 interpreter_python = auto_silent
 
 [ssh_connection]

infra/ansible/roles/cilium/templates/cilium-values.yaml.j2

@@ -17,6 +17,12 @@ gatewayAPI:
 egressGateway:
   enabled: true
 
+# Egress Gateway REQUIRES masquerade (ipv4 + eBPF). eBPF masquerade is the correct
+# pairing with kubeProxyReplacement. [parity] must match platform/cilium HelmRelease.
+enableIPv4Masquerade: true
+bpf:
+  masquerade: true
+
 # Flow observability / isolation audit (ADR-0002).
 hubble:
   enabled: true