Make router health checks bounded and non-blocking

[Yiqing Wang (YQ-Wang)]

Summary

• make the Kubernetes /version health check observe the router context and a 500 ms dependency timeout
• perform dependency network calls without holding the health report mutex, allowing /statusz to serve the most recently completed report
• preserve health timestamps and counters with an atomic report update after each check cycle
• add regression coverage for timeout, cancellation, report/status responsiveness, and health accounting

Root cause

The client-go Discovery().ServerVersion() helper uses context.TODO() internally. If the Kubernetes API accepted /version but withheld its response, canceling the router context could not terminate the request. The router also held the report mutex across dependency network calls, so the stalled request blocked /statusz and delayed shutdown.

Validation

• make verify
• go test ./cmd/atenet/internal/router -run 'Test(CheckK8s|HealthCheck|HealthStart)' -count=20
• go test -race ./cmd/atenet/internal/router -count=1
• Kind Kubernetes v1.36.1 fault injection: a proxy fetched the real cluster /version response and withheld it; /statusz remained responsive with HTTP 200, the request was canceled at the 500 ms deadline, and one Kubernetes health failure was recorded

Fixes #490