Improve segmentation service mesh bypass gates

[DENGXUELIN]

Summary

• add a service mesh bypass evidence gate for hostNetwork, hostPort, sidecar injection, strict mTLS, CNI enforcement, node-local paths, and exception expiry
• extend the micro-segmentation readiness and report output fields for mesh bypass and default-deny evidence
• add vulnerable and benign segmentation fixtures covering host-network mesh bypass and strict default-deny controls

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check
• Added-line ASCII check
• Content marker check for service mesh bypass, hostNetwork, hostPort, default-deny, CNI enforcement, sidecar injection, mTLS, exception owner, and expiry
• git merge-tree --write-tree origin/main HEAD

Closes #1916

Bounty request: Improver Moderate / USD 100 if accepted.