Release network integration fixes in v0.3.10

[chen21019]

Result

• Publish Network Services version 6 with Network Plugin Manager v0.8.18.
• Publish Layer 2 Flat Network version 4 with the v0.14.36 CNI runtime.
• Keep existing template versions immutable and make the new versions the defaults.

Why

Two-host Ubuntu 26.04.1 testing found two integration defects that isolated tests did not expose: published host-port DNAT could make VXLAN traffic asymmetric, and the previously bundled bridge CNI ignored skipBridgeConfigureIP and added a conflicting address to an operator-managed bridge.

Validation

• Network Plugin Manager v0.8.18 release and runtime security gates passed.
• IPsec/CNI v0.14.36 security release gate, CodeQL verification, packaged CNI namespace gate, release identity, SHA-256, and runtime scan passed.
• Catalog image inventory, numeric version labels, firewall backend contract, JSON parsing, and deployable image audit pass locally.
• The Catalog service integration workflow must pass before merge.