Flaky netns tests at 2% loss: fallback join ping, upgrade_check_healthy, vip/trixie #94

Seen 2026-10-10/11 on PRs #90 and #93 (a docs-only commit): test_mesh_netns.test_c_joins_through_the_fallback (ping over the overlay right after the fallback join), vip-upgrade's upgrade_check_healthy after a member restart (fail-closed timing), and one vip / trixie run on #93 with no code change. Reviews judged them test timing sensitivity, not product bugs. Harden: retry the post-join ping for up to the handshake window, wait for endpoint health with a bounded retry instead of a single call, and make each scenario assert on medians over a few attempts where the link is lossy. Keep the measured-link check strict.