fix(canopy): run proxy as a native sidecar so canopy Jobs complete

[passcod]

🤖 The canopy-proxy was added as a plain container in the restore and
snapshot-list Jobs. In a Job Pod (restartPolicy: Never) the kubelet
doesn't stop still-running containers when another exits, so once the
main kopia container finished, the proxy kept serving and the Pod never
reached a terminal phase. The Job sat Active until
activeDeadlineSeconds fired → DeadlineExceeded → Failed, even
though the snapshot-list callback had already been POSTed successfully.

Confirmed on the live cluster: the failed canopy-replica-snapshot-list
Job showed reason=DeadlineExceeded, both containers plain, no init
containers.

Fix

Move the proxy to a native sidecar — an init container with
restartPolicy: Always. The kubelet keeps it running alongside the main
container and SIGTERMs it once the main container exits, so the Pod
completes on the main container's exit code. Needs k8s ≥ 1.29
(SidecarContainers GA); target cluster is 1.34.

Two supporting changes:

• The proxy now waits on SIGTERM as well as SIGINT. tokio's
  ctrl_c() only catches SIGINT, so under k8s the proxy would have hung
  until SIGKILL and lost its final traffic stats.
• Both canopy Job Pods get a 30s terminationGracePeriod so the sidecar
  can flush its stats callback on SIGTERM.

Regression test canopy_restore_job_proxy_is_native_sidecar asserts the
proxy is an init container with restartPolicy=Always and not a plain
container.