CI: Conformance Runtime (ci-runtime): Runtime (agent): DNS proxy policy works if Cilium stops

[gandro]

CI: Conformance Runtime (ci-runtime): Runtime (agent): DNS proxy policy works if Cilium stops

[gandro]

Also found in an earlier run https://github.com/cilium/cilium/actions/runs/9548860479/job/26317322574

[gandro]

I think the following is happening right now:

1. We do a lookup for world1.cilium.io, it returns exactly 1 IP per IP family. We allocate one FQDN identity (fqdn:world1.cilium.io,reserved:world-ipvN) per family
2. We shut down Cilium, where it didn't manage to checkpoint the latest FQDN identities
3. Cilium comes up again, it sees the IP(s) in IPCache and withholds the numeric identity. Because it has no labels and the identity is unique to the IP, it adds a cidr label. The IP is therefore added as a "restored" CIDR idenity to the new cache
4. FQDN policy is re-imported (after endpoint regeneration!), because it now adds a fqdn:world1.cilium.io label to the IP, we allocate a new numeric identity for the IP
5. The test check numeric identities and is unhappy about the fact that identities changed

[gandro]

The "good" news is that this identity change shouldn't actually cause drops, because it's happening after restoration and this is mainly a false positive in terms of test failure. Still, we want to fix either the test or the check-pointing (or both)