test(kubernetes): add optional Envoy-backed e2e mode

[elezar]

Summary

Add an optional Envoy-backed execution mode for the standard single-replica Kubernetes E2E suite. The mode layers the existing Gateway API values, disables Envoy request and stream duration limits for OpenShell's long-lived gRPC streams, discovers the generated proxy Service, and keeps the existing direct-Service mode as the default.

Related Issue

Extracted from the generally applicable E2E setup in #1868. PR #2108 changes the chart's Gateway API values schema; this draft intentionally targets the schema on current main and may need a small rebase adjustment if #2108 lands first.

Changes

• Add mise run e2e:kubernetes:envoy for local opt-in execution.
• Add a use-envoy-gateway input to the reusable Kubernetes E2E workflow.
• Reuse an existing Envoy controller without upgrading or uninstalling its release.
• Install Envoy with helm install only when no controller is present, using a unique test-owned namespace.
• Create uniquely named test-owned GatewayClass and BackendTrafficPolicy resources, refusing to modify pre-existing resources with those names.
• Delete only Envoy resources whose creation was recorded by the current invocation.
• Route the client port-forward through the generated Envoy proxy Service while preserving the readyz health port-forward and default direct-Service path.

Testing

• bash -n e2e/with-kube-gateway.sh
• git diff --check
• Helm lint with ci/values-gateway.yaml
• Helm render of Gateway and GRPCRoute with the per-run GatewayClass override
• Workflow YAML parse
• Focused shell simulations for existing-controller reuse, pre-existing namespace/Class refusal, and created-resource-only cleanup
• mise run pre-commit completes (lint, format, workspace/E2E Clippy, Helm, Python, and other reported checks passed; the first run hit a fresh-virtualenv grpc_tools bootstrap race, and the rerun reached the five-minute command timeout during full Rust tests)
• Kubernetes E2E (Docker was unavailable locally)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Runtime mode and reusable workflow exposure are separate logical commits
• No HA replicas, PostgreSQL setup, HA tests, or HA caller/profile changes are included

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.