feat(helm): migrate gateway configuration to gatewayConfig

[gmenher]

Summary

Replace the Helm chart's field-by-field gateway.toml generation with a generic, schema-v2 gatewayConfig boundary. Remove the legacy mirrored application configuration contract, preserve a non-secret ConfigMap boundary and Helm-owned Secret wiring, and derive dual-use runtime settings from their Kubernetes packaging owners so rendered resources and gateway configuration remain coherent.

Related Issue

Closes #3060.

Changes

• Add a complete working schema-v2 gatewayConfig default and a deterministic generic YAML-to-TOML renderer.
• Restrict gatewayConfig to non-secret values; retain Secret, environment, file, and volume wiring for credentials and private material.
• Remove legacy application-only chart values, aliases, manual TOML construction, field-specific rendering, and their tests.
• Derive dual-use runtime values from Helm-owned Service, TLS/PKI, Route, RBAC, NetworkPolicy, OIDC CA, SPIFFE, credential-driver, image-pull-secret, supervisor-image, and host-gateway settings.
• Migrate CI, development, Skaffold, workspace, OpenShift, TLS, proxy, credential-driver, OIDC, and SPIFFE overlays.
• Add parser-backed rendering and resource-coherence validation, plus tests for conversion semantics, secret exclusions, checksum rollouts, TLS and host-gateway ownership.
• Update chart, Kubernetes, architecture, reference, and migration documentation, including the 0.1.0 breaking-change guide.

Testing

• mise run helm:test (153 chart tests and 4 workspace tests)
• mise run helm:lint across chart overlays
• Gateway TOML parser and resource-coherence scripts
• mise exec -- skaffold diagnose
• bash e2e/parity/kubernetes-options-test.sh
• RUST_TEST_THREADS=1 OPENSHELL_E2E_KUBE_TEST=host_gateway_alias mise run e2e:kubernetes
• Advanced proxy E2E configuration, run serially

The full concurrent Kubernetes E2E suite also exposed an upstream RFC 0012 stopped-sandbox lifecycle failure outside this PR's diff; the focused configuration migration E2E passes.

Checklist

• Commits include DCO Signed-off-by trailers.
• Documentation and migration guidance are updated.
• Helm render, parser, unit, integration, and focused E2E coverage have been run.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[krishicks]

/ok to test c5afa06

[github-actions]

Label test:e2e applied, but pull-request/3384 is at c5afa06 while the PR head is cb8ae8b. A maintainer needs to comment /ok to test cb8ae8bba78baed32b09240a49abbcf7f5509c92 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

[krishicks]

/ok to test cb8ae8b

[gmenher]

@krishicks I pushed a new commit solving a conflict with e2e/rust/e2e-kubernetes.sh that was blocking the merge.

[krishicks]

/ok to test 5efe3e8