Bump kube-router to v2.10+ and expose --netpol-default-deny so NetworkPolicy covers pod startup

Is your feature request related to a problem? Please describe.

NetworkPolicy is not enforced for a new pod's first few hundred milliseconds. The embedded kube-router NPC programs a pod's KUBE-POD-FW-* chain only after the pod's IP shows up in the API, and until then the pod's traffic falls through to ACCEPT. This was reported in #947 and #13432; in #13432 @brandond said K3s would track a kube-router bump once kube-router had a way to address it.

kube-router now has one. cloudnativelabs/kube-router#2079 (in v2.10.0) adds --netpol-default-deny: it keeps a kube-router-local-pods ipset of pod IPs whose chain has been installed, and REJECTs traffic to/from any IP in the node's spec.podCIDRs that is not yet in the set. It is off by default and self-disables if the node's pod CIDRs can't be determined.

K3s can't use it yet:

• go.mod on main still pins k3s-io/kube-router/v2 v2.6.3-k3s1, although the fork already has a v2.10.0-k3s1 tag.
• pkg/agent/netpol/netpol.go builds the KubeRouterConfig itself and never sets NetPolDefaultDeny, so there is no way to turn it on.

Describe the solution you'd like

• Bump kube-router to v2.10.0-k3s1 or later.
• A way to enable default-deny on the embedded NPC, e.g. an agent flag --netpol-default-deny (off by default, like upstream). K3s starts kube-controller-manager with --allocate-node-cidrs=true, so node.spec.podCIDRs is populated and the feature's CIDR detection works without further configuration.

Describe alternatives you've considered

• Sleeping or retrying in workloads. That handles eventual connectivity, but nothing a workload does can close the window in which an already-running container has unfiltered egress; only the node-side rule can.
• Disabling the embedded NPC (--disable-network-policy) and running kube-router or another CNI with policy support separately. A lot of machinery for one flag.

Additional context

Real-world case: a deploy-time check that runs a pod with the labels a policy selects and probes what it can reach. Without a 5 s sleep after the pod is Ready, every probe reports "reachable" because the rules aren't there yet: https://github.com/mc-chat-app/wishblock/blob/main/deployer/src/network.rs#L139-L142