Harvest the legacy VIPs allocator and persistence subsystem

[Automaat]

Part of #17439. Lands after #17442 (needs the mesh_context_builder.go:172 branch gone). Independent of #17443 — can run in parallel with it.

The largest deletion in the epic: roughly 1,700 LOC production + 1,900 LOC test.

Why it is dead

pkg/xds/context/mesh_context_builder.go:173 is the only non-self-referential reader of the persisted VIP config (the kuma-<mesh>-dns-vips Config resource). The only other Persistence.Get/GetByMesh callers are vips_allocator.go:154,179 — the allocator reading back its own writes. Once #17442 removes that branch, the whole subsystem is write-only.

Delete

• pkg/dns/vips_allocator.go — 503 LOC (+885 test)
• pkg/dns/vips/ — whole package, ~723 LOC (+894 test): persistence.go 173, tag_first_virtual_outbound_view.go 222, virtual_outbound_view.go 133, interfaces.go 70, global_view.go 65, virtual_outbound.go 60
• pkg/dns/metrics/metrics.go — 37 LOC, only consumer is the allocator
• pkg/xds/topology/dns.go:13-78 — VIPOutbounds only. Outbounds/Domains at 80-95 stay — they serve MeshService/MeshExternalService/MeshMultiZoneService.
• pkg/plugins/runtime/k8s/controllers/configmap_controller.go — 266 LOC, exists to drive VIPsAllocator.CreateOrUpdateVIPConfig
• pkg/plugins/runtime/k8s/controllers/kube_hosts_converter.go — 84 LOC, only used by configmap_controller
• addDNS in pkg/plugins/runtime/k8s/plugin.go:265-297 and pkg/plugins/runtime/universal/plugin.go:38-73
• pkg/core/resources/apis/mesh/virtual_outbound_helpers.go — FilterTags (68) only. EvalPort (42) and EvalHost (57) stay — still called from virtual_outbound_validator.go:84,102.
• Config: Experimental.UseTagFirstVirtualOutboundModel (pkg/config/app/kuma-cp/config.go:462,284), DNSServer.ServiceVipEnabled, DNSServer.CIDR, Runtime.Universal.VIPRefreshInterval (pkg/config/plugins/runtime/universal/config.go:43)

Do NOT delete

• pkg/dns/virtual_outbound_selector.go (dns.Match) — second caller at pkg/xds/generator/zoneproxy/destinations.go:292, inside addVirtualOutboundDestinations → buildKumaIoServiceDestinations → BuildMeshDestinations, which is not mode-gated.
• The VirtualOutbound resource type — same path consumes it (destinations.go:114) for legacy zone-proxy SNI destinations. It stays registered, validated, API/KDS-served, with a CRD. Removing the allocator makes it mostly inert but not unreachable; deprecating it is separate.
• DNSServer.Domain and DNSServer.ServiceVipPort — pkg/api-server/server.go:334 still uses both for the ServiceInsight addressPortGenerator. They only die if ServiceInsight goes, which is out of scope.

Verification

DNS for dataplanes must keep working: pkg/xds/generator/dns_generator.go reads xdsCtx.Mesh.VIPDomains, still populated from the MeshService/MES/MZMS Domains() path. Worth an explicit e2e check rather than trusting unit tests.

Notes

• Removing config fields is user-visible — UPGRADE.md note and changelog required.
• Likely needs splitting across a few PRs to stay reviewable.