Merge fix/phase1-execution into main

infra/ansible/ansible.cfg

@@ -3,7 +3,9 @@ inventory = inventory/hosts.ini
 roles_path = roles
 host_key_checking = False
 retry_files_enabled = False
-stdout_callback = yaml
+# ansible-core 2.20 removed community.general.yaml; use the builtin default with YAML result format.
+stdout_callback = default
+result_format = yaml
 interpreter_python = auto_silent
 
 [ssh_connection]

infra/ansible/roles/cilium/templates/cilium-values.yaml.j2

@@ -17,6 +17,12 @@ gatewayAPI:
 egressGateway:
   enabled: true
 
+# Egress Gateway REQUIRES masquerade (ipv4 + eBPF). eBPF masquerade is the correct
+# pairing with kubeProxyReplacement. [parity] must match platform/cilium HelmRelease.
+enableIPv4Masquerade: true
+bpf:
+  masquerade: true
+
 # Flow observability / isolation audit (ADR-0002).
 hubble:
   enabled: true