fix(ateapi): mark atelet churn unavailable

[NekoPunch (orangeCatDeveloper)]

Fixes #646

Summary

When the atelet DaemonSet pod on a node is being replaced (routine during node upgrades), DialForWorker fails with a plain fmt.Errorf, so the interceptor defaults it to codes.Internal — clients are told not to retry an error that self-heals in seconds (#646). The two transient paths (atelet pod count ≠ 1, no assigned IPs) now return codes.Unavailable: the interceptor extracts the code through %w wrapping, the router parks and retries per docs/request-parking.md, and unrecoverable cases surface as 503 with Retry-After: 1 (added to the router's immediate responses, 503 only).

Scope, per #646's own dedup notes: worker-pod-side lookups ("expected 1 pod match") stay as-is (#600's territory), credential/connection build failures remain Internal, and the full workflow-step audit is the inverse direction of #605.

Test plan

• dialer: fake-informer scenarios (zero atelets, two atelets, atelet without IPs) assert Unavailable; a wrapping test asserts the code survives fmt.Errorf("...: %w", err) as the workflows wrap it; ErrWorkerPodNotFound sentinel unaffected
• router: retry-after: 1 present on 503 immediate responses, absent on 500/504/403; RawValue encoding pinned

[Max Smythe (maxsmythe)]

Bowei Du (@bowei) to evaluate networking impact and/or route review