fix(microvm): pin guest IPv6 identity to a cluster ULA

The ISP retires delegated prefixes, so a guest that registers its WAN prefix
loses it and Cilium never refreshes the node address. Derive the identity from
the IPv4 octets inside fd05:5::/64 and trust that ULA in the guest firewall.

vars/networking.nix

@@ -8,6 +8,8 @@ rec {
   # it's a subrouter with a transparent proxy
   proxyGateway = "192.168.5.178";
   proxyGateway6 = "fe80::8";
+  # node identity must not ride the WAN /64: the ISP retires it, Cilium never refreshes it.
+  clusterULA6 = "fd05:5::";
   nameservers = [
     # IPv4
     "119.29.29.29" # DNSPod https://www.dnspod.cn/Products/publicdns