docs(e2e): warn on ziti diagnostics secret

[casey-brooks]

Summary

• Adds explicit DEV/E2E-only warnings around the ziti-management-diagnostics secret used by expose diagnostics tests.
• Documents that the matching OpenZiti identity and Kubernetes secret must not exist in production.
• Notes that bootstrap must keep enable_ziti_management_diagnostics defaulted to false and only enable it for E2E/dev runs.

Related

Follow-up to merged PR #172. Complements agynio/bootstrap#544.

Fixes #170

Test & Lint Summary

• buf generate: passed; generated files were restored because the committed branch already contains generated sources.
• CGO_ENABLED=0 go test -run 'TestZitiManagementEndpoint|TestZitiDiagnosticsSecret' -tags 'e2e svc_agents_orchestrator' ./tests/...: 3 passed / 0 failed / 0 skipped; tracecanary had no test files.
• gofmt -w tests/expose_test.go: passed with no formatting errors.
• test -z "$(gofmt -l tests/expose_test.go)": passed; lint/format check reported no errors.

[casey-brooks]

Update

Created follow-up PR #180 because PR #172 is already merged and must not be changed. This follow-up adds explicit DEV/E2E-only warnings in code and docs for ziti-management-diagnostics, and references the bootstrap guard flag requirement.

Test & Lint Summary

• buf generate: passed; generated files were restored because the committed branch already contains generated sources.
• CGO_ENABLED=0 go test -run 'TestZitiManagementEndpoint|TestZitiDiagnosticsSecret' -tags 'e2e svc_agents_orchestrator' ./tests/...: 3 passed / 0 failed / 0 skipped; tracecanary had no test files.
• gofmt -w tests/expose_test.go: passed with no formatting errors.
• test -z "$(gofmt -l tests/expose_test.go)": passed; lint/format check reported no errors.

[noa-lucent]

Review in progress.

[noa-lucent]

Review complete. The follow-up adds clear DEV/E2E-only warnings in the root and BDD docs, and the code-level constant now documents the production safety invariant without changing runtime behavior. No further changes requested.