feat(helm): migrate gateway configuration to gatewayConfig

[gmenher]

Summary

Migrate the Helm chart from field-by-field gateway.toml construction to the schema-v2 gatewayConfig boundary while preserving the non-secret ConfigMap boundary and Helm-owned Secret, volume, and resource wiring.

Related Issue

Closes #3060.

Compatibility

This implementation is backwards-compatible for 0.1.x:

• Retains the deprecated sandboxRuntime, supervisor, upstreamProxy, and Kubernetes driver aliases for existing values files.
• gatewayConfig is authoritative whenever both the schema-v2 field and its legacy alias are supplied.
• Resolves aliases once and uses the same effective Kubernetes driver configuration for rendered TOML, validation, NetworkPolicy acknowledgement, and RBAC/workspace resources.
• Validates schema-v2 proxy authentication Secret references and keeps private material outside gatewayConfig.

Changes

• Add deterministic generic YAML-to-TOML rendering for the schema-v2 configuration boundary.
• Preserve chart-owned deployment inputs and derive runtime values from their resource owners.
• Cover legacy-to-schema-v2 compatibility, explicit precedence, workspace modes, NetworkPolicy acknowledgement, proxy CA wiring, and Secret-reference validation with Helm tests.
• Add parser-backed rendering and resource-coherence validation.
• Update Helm, Kubernetes, architecture, reference, and migration documentation.

Testing

• mise run ci
• mise run helm:test (170 gateway-chart tests and 5 workspace-chart tests)
• mise run helm:lint across chart overlays
• Gateway TOML parser and resource-coherence validation
• CodeRabbit review; its Secret-reference finding is covered by a regression test

Checklist

• Commits include DCO Signed-off-by trailers.
• Documentation and generated Helm README are updated.
• Compatibility and schema-v2 precedence are covered by tests.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[krishicks]

/ok to test c5afa06

[github-actions]

Label test:e2e applied, but pull-request/3384 is at c5afa06 while the PR head is cb8ae8b. A maintainer needs to comment /ok to test cb8ae8bba78baed32b09240a49abbcf7f5509c92 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

[krishicks]

/ok to test cb8ae8b

[gmenher]

@krishicks I pushed a new commit solving a conflict with e2e/rust/e2e-kubernetes.sh that was blocking the merge.

[krishicks]

/ok to test 5efe3e8

[krishicks]

/ok to test cfae1b6

[krishicks]

I added this to to 0.1.1 milestone as we're freezing what goes into 0.1.0. For this to actually land in 0.1.1 it would need to be implemented in a backwards-compatible way. Failing that this would need to be pushed to 0.2.0 which is the next release where breaking changes can get in.

[dvavili]

@gmenher @krishicks We are waiting for this change to land to unblock a few deliverables. If there is anything pending on this PR, happy to contribute.