ci: run real-agent datapath e2e nightly + on relevant PRs

[syscod3]

Summary

The real-agent datapath e2e job (validated end-to-end in #35) was manual-dispatch-only -- nothing runs it unless someone remembers to. This moves it to a routine cadence so a regression in the wake-on-traffic/suspend-resume path is caught automatically, without slowing down the fast push/PR gate everyone hits on every commit.

What changed

• Moved "E2E Datapath (Kind, real agent)" out of ci.yml into a new nightly-e2e-datapath.yml, matching the existing nightly-e2e.yml/nightly-e2e-cilium-heavy.yml pattern (concurrency group, timeout-minutes, retry-once, diagnostics-on-failure artifact upload).
• Triggers: nightly at 04:00 UTC (staggered after the existing 02:00/03:00 nightly jobs), plus automatically on any PR touching the datapath fragile paths (internal/agent/scaletozero*.go, internal/agent/network/, internal/agent/reconciler.go, internal/capability/, charts/imp/templates/agent/**, the datapath test/Kind config, or this workflow file itself).
• E2E Smoke (Kind) in ci.yml is untouched -- still the fast always-on push/PR gate.
• Added a Telegram notify-on-failure step for scheduled/manual runs (not PR runs, since a failing PR check is already visible there), reusing the org existing bot pattern from oci-free-tier-monitor. Skips cleanly until TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID are added as repo secrets -- not yet configured, tracked as a follow-up.

Test plan

• Both workflow files pass yaml safe_load and shellcheck severity=warning
• CONFIRMED via GitHub API: new workflow files only register triggers once merged to the default branch -- this PR cannot self-validate its own path-trigger; validation happens post-merge (see below)
• Nightly schedule trigger can only be validated once merged to main (GitHub only registers workflow_dispatch and schedule from the default branch for new workflow files)

---