fix: provision actor egress policies with Substrate v0.0.30 (#2839)

Substrate v0.0.30 enforces egress policies. Without an actor policy,
model and MCP requests fail with HTTP 403 (`EgressPolicy not found`).
Upgrade the Go dependency and CI/local cluster pins from v0.0.29 to
v0.0.30.

Creation and fork now ensure the actor's default egress policy before
marking the instance READY. Rules come from the revision's configured
destinations. Retries reuse existing actors and verify existing policies
match; conflicting policies fail without being overwritten. This uses
the existing workflow state, with no new database state or migration.

Adds coverage for partial failures, concurrent actor creation, policy
validation, and E2E access to an allowed model endpoint with denial of a
redirect to an unconfigured destination. Existing READY instances are
not backfilled.

Validation:
- Full E2E suite: all 34 top-level tests passed against Substrate
v0.0.30, including Codex, Claude, checkpoint/fork, and HTTP egress
denial.
- Affected Substrate, agent instance, checkpoint, and controller package
tests passed.
- `make -C go lint`: 0 issues.
- Helm packaging/lint and `git diff --check` passed.

---------

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>