[kfeofantov]

Setting spec.trafficDistribution asks for zone-local traffic. The
EndpointSlice controller decides whether to arrange it, and declines whenever the
endpoints are distributed too unevenly against the zones' CPU capacity. There is
no event, no condition and no status field: a Service whose routing works and one
whose routing was refused read identically in kubectl get svc, and the second
keeps paying a cross-zone transfer bill its owner believes they eliminated.

What ships. workload_policy now carries, per Service: traffic_distribution,
topology_mode (the two annotations that asked for this before the field
existed), and ready-endpoint counts by zone with how many the cluster gave
hints.forZones. The finding is one comparison on one payload — a mode set
against hinted: 0 — and needs no history, so it belongs to the first-hour
report.

No endpoint identity is read. Addresses (pod IPs), targetRef, nodeName,
hostname and the deprecated topology map are removed as the object enters the
cache (ADR 0046), so they are never held rather than held and dropped. The join
to a pod is never made, which is what keeps the counts clear of invariant 6. It
also bounds memory: a Service with thousands of endpoints would otherwise carry
thousands of addresses for the life of the process.

Counts are per address family. A dual-stack Service lists each pod once in an
IPv4 slice and once in an IPv6 slice. Merged, every zone doubles — uniformly, so
the skew still looks right while every absolute number is wrong. MUST NOT sum across families is stated in backend-requirements.md.

RBAC. Adds discovery.k8s.io/endpointslices (get/list/watch) — the first
resource in that group. Without it the cache never syncs, endpoint_slices names
itself in unavailable_sources, and the Services still ship (ADR 0033).

Two things the real cluster taught this PR: the API server warns that
PreferClose is deprecated in favour of PreferSameZone, which is a second
reason the value is passed through verbatim rather than normalized to a closed
set — the vocabulary moves and the agent cannot be updated to follow it. The e2e
now sets the current spelling and the unit tests keep the deprecated one, because
a fleet mid-migration has both.

backend-requirements.md ceiling 475 → 495; security.md fits under its
existing one.

Evidence:

go test -race ./... && make lint && make chart-lint   # green
make policy-e2e
# service web asked for PreferSameZone; 2 ready endpoints, 2 hinted,
# zones map[e2e-zone-a:2]

🤖 Generated with Claude Code

https://claude.ai/code/session_011YRKuL97KRndaopfpixrhp