Label observable iron-proxy resources

[blokboy]

Addressing Issue #1024.

• Threads observability_enabled into iron_proxy_labels.
• Adds centaur.ai/observability-enabled=true to iron-proxy pod metadata when enabled.
• Adds it to service metadata and service selectors.
• Adds it to the proxy NetworkPolicy metadata and pod selector.
• Uses the expanded labels for sandbox-to-proxy peer selection.
• Adds enabled/disabled assertions so restricted proxies do not get the observability or API-server capability labels.

So the chart-level networkPolicy.observabilityEgress selector should now be able to match observability-enabled iron-proxy pods. Validation was cargo test -p centaur-sandbox-agent-k8s, not Helm rendering or a Kubernetes reproduction.