test(kubernetes): add optional Envoy-backed e2e mode

[elezar]

Summary

Add an optional Envoy-backed execution mode for the standard single-replica Kubernetes E2E suite. The mode exercises the Gateway API/Envoy GRPCRoute path without enabling HA, changing replica counts, or requiring PostgreSQL.

Direct Service port-forwarding remains the default. Envoy mode installs or reuses an Envoy Gateway controller, creates test-owned Gateway API resources, disables Envoy request and stream duration limits for OpenShell's long-lived gRPC streams, discovers the generated proxy Service, and routes the client port-forward through that Service.

Related Issue

Extracted from the generally applicable Envoy/Gateway API setup in #1868. This PR intentionally leaves HA gateway rebalancing, multi-replica behavior, and external PostgreSQL coverage out of scope while the HA tests are not yet functional.

Changes

• Add mise run e2e:kubernetes:envoy for local single-replica Envoy execution.
• Add OPENSHELL_E2E_KUBE_USE_ENVOY=1 support to the Kubernetes e2e wrapper.
• Add a use-envoy-gateway input to the reusable Kubernetes E2E workflow.
• Add one core Kubernetes E2E matrix leg with topology: envoy and use-envoy-gateway: true.
• Reuse an existing Envoy controller without upgrading or uninstalling its release.
• Install Envoy with helm install only when no controller is present, using a unique test-owned namespace.
• Create uniquely named test-owned GatewayClass and BackendTrafficPolicy resources, refusing to modify pre-existing resources with those names.
• Delete only Envoy resources whose creation was recorded by the current invocation.
• Route the client port-forward through the generated Envoy proxy Service while keeping the default direct-Service path unchanged.

Testing

• bash -n e2e/with-kube-gateway.sh
• git diff --check
• Workflow YAML parse through the OpenShell devenv with pinned uv/PyYAML
• Helm lint with ci/values-gateway.yaml
• Helm render of Gateway and GRPCRoute with the per-run GatewayClass override
• Focused shell simulations for existing-controller reuse, pre-existing namespace/Class refusal, and created-resource-only cleanup
• mise run pre-commit completes (lint, format, workspace/E2E Clippy, Helm, Python, and other reported checks passed; the first run hit a fresh-virtualenv grpc_tools bootstrap race, and the rerun reached the five-minute command timeout during full Rust tests)
• Kubernetes E2E (Docker was unavailable locally)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Runtime mode and reusable workflow exposure are separate logical commits
• Envoy coverage is single-replica and does not add HA replicas, PostgreSQL setup, or HA tests

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[drew]

What's the motivation for this? Is it to make sure we can test HA deployments?

[elezar]

The primary motivation for this PR (and some of the others) was to reduce the surface of #1868 (adding HA support) somewhat. This includes adding Envoy configuration / deployments to provide a stable endpoint for the HA case.

As reviewed, the PR added the option but didn't actually exercise any of the added functionality. Since using Envoy is a separate from an HA deployment, I have updated the PR to add an "envoy-enabled" path to the existing tests. This should mean that we can shake out any issues with the envoy-gateway interaction separately from the HA functionality.

Depending on the load on CI, we can consider removing it again or simplifying our test matrix for k8s once HA support lands.

[elezar]

/ok-to-test 9b5c53e