backport: cherry-pick critical bugfixes to release-1.15

[oilbeater]

Summary

Backport 8 critical bugfixes from master to release-1.15:

• fix(informer): return nil instead of error in VM indexer to prevent client-go panic #6537 fix(informer): return nil instead of error in VM indexer to prevent client-go panic
• fix(controller): use defer to protect vpcKeyMutex unlock #6515 fix(controller): use defer to protect vpcKeyMutex unlock in subnet handler (deadlock prevention)
• fix: protect ANP/BNP/CNP priority maps from concurrent access #6373 fix: protect ANP/BNP/CNP priority maps from concurrent access (fatal panic prevention)
• fix(daemon): harden protocol iteration and bounds checks in gateway #6547 fix(daemon): harden protocol iteration and bounds checks in gateway (IPv6-first dual-stack panic)
• fix(controller): prevent invalid ACL generation for named ports and IPBlock except CIDRs #6536 fix(controller): prevent invalid ACL generation for named ports and IPBlock except CIDRs (security)
• fix(daemon): skip invalid policy routing rules when pod lacks matching protocol IP #6522 fix(daemon): skip invalid policy routing rules when pod lacks matching protocol IP (traffic hijack prevention)
• fix(ha): detect and recover from split-brain leader with incomplete cluster membership #6363 fix(ha): detect and recover from split-brain leader with incomplete cluster membership
• fix: wrap EIP error shadowing and use uint64 for iptables counters #6538 fix: wrap EIP error shadowing and use uint64 for iptables counters (overflow fix)

Skipped (not applicable to 1.15)

• fix(controller): resolve variable shadowing causing IPAM key mismatch in per-interface static IP #6484 per-interface static IP variable shadowing — feature not present on release-1.15
• fix(daemon): create listen sockets before starting controller to avoid race #6478 daemon listen socket race — metrics server refactor conflicts too large, needs manual adaptation

Adaptation notes

• #6363: replaced ovs.OvnDatabaseControl() (master-only API) with direct exec.Command("ovn-appctl", ...) call
• #6538: manually updated GwIPtableCounters → GwIPTablesCounters rename across daemon package

Test plan

• make build-go — compilation passes
• make lint — no new lint issues (pre-existing gosec G703 on cniserver.go unchanged)
• go test ./pkg/controller/... — passes
• go test ./pkg/daemon/... — passes
• go test ./pkg/ovs/... — passes
• go test ./pkg/util/... — passes
• E2E tests in CI

🤖 Generated with Claude Code

[coveralls]

Pull Request Test Coverage Report for Build 23779251406

Details

• 35 of 134 (26.12%) changed or added relevant lines in 10 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.1%) to 23.488%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
pkg/controller/vpc_nat_gw_eip.go	0	1	0.0%
pkg/controller/ovn_eip.go	0	2	0.0%
pkg/informer/kubevirt.go	0	2	0.0%
pkg/daemon/controller_linux.go	7	10	70.0%
pkg/controller/admin_network_policy.go	0	5	0.0%
pkg/ovs/ovn-nb-acl.go	28	36	77.78%
pkg/controller/cluster_network_policy.go	0	12	0.0%
pkg/controller/subnet.go	0	13	0.0%
pkg/daemon/gateway_linux.go	0	16	0.0%
pkg/ovn_leader_checker/ovn.go	0	37	0.0%

Totals
Change from base Build 23776815408:	0.1%
Covered Lines:	12791
Relevant Lines:	54458

---

💛 - Coveralls