demos: add outbound connectivity probe to counter

[NekoPunch (orangeCatDeveloper)]

Summary

Resolves the counter.go TODO ("Test outbound connectivity by pinging google.com"): each count tick now fetches a URL and logs the result, demonstrating that the actor's egress path keeps working across suspend/resume. The probe uses HTTP instead of ICMP (no raw sockets in the sandboxes) and disables keep-alive so every tick proves a fresh DNS+dial rather than a still-open socket.

Both demo deploy paths default the probe to https://www.google.com/generate_204 via a new optional template arg; OUTBOUND_PROBE_URL overrides the target and an empty value disables it for air-gapped clusters. The micro-VM template gains an explicit command block (matching the gVisor one) so the same substitution works there.

Test plan

• Rendered both templates with the probe enabled/custom/disabled and asserted the resulting YAML args (bash -n on both scripts).
• Ran the linux binary in a container against a local 204 endpoint: one probe log per tick, fresh connection each time.
• End-to-end on a kind cluster (gVisor sandbox class): deployed the demo, created an actor, observed Outbound probe succeeded status=204 for google.com/generate_204 every 10s; suspended and resumed the actor and confirmed the first tick after Actor restored probes successfully.

---

• Tests pass
• Appropriate changes to documentation are included in the PR

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.