feat(helm): support agentgateway ingress

[danehans]

Problem Statement

OpenShell documents and tests Envoy Gateway as its Kubernetes Gateway API implementation. Operators using agentgateway lack a supported setup, and simply setting grpcRoute.gateway.className=agentgateway is unsafe: agentgateway names its generated Service after the Gateway, which collides with OpenShell's default openshell Service name.

Proposed Design

Keep the Helm chart controller-neutral and manage agentgateway separately as cluster infrastructure.

• Document a production path that attaches OpenShell's GRPCRoute to a shared agentgateway Gateway.
• Support a dedicated chart-created Gateway for development when it has a non-conflicting name.
• Add an optional parent listener sectionName for shared Gateways.
• Generalize Envoy-specific chart text without changing the existing eg default.
• Add agentgateway values, setup tasks, troubleshooting guidance, and a Kubernetes E2E test that runs OpenShell CLI and sandbox operations through the agentgateway data plane.
• Preserve the current TLS model: agentgateway terminates TLS and OpenShell validates OIDC bearer tokens.

Alternatives Considered

• Documentation-only class override: rejected because of the Service name collision and lack of runtime coverage.
• Bundling agentgateway with the OpenShell chart: rejected because cluster-scoped CRDs and controller lifecycle should remain platform-owned.
• TLS/TCP passthrough: deferred because it loses gRPC-aware routing and expands the chart surface.

Agent Investigation

The existing Gateway and GRPCRoute templates are portable. Agentgateway supports both resources and HTTPS listeners, but its generated data-plane resources use the Gateway name. The recommended shared-Gateway model avoids that collision and keeps agentgateway-specific policy resources outside the OpenShell chart.

Checklist

• I've reviewed existing issues and the architecture docs
• This is a design proposal, not a "please build this" request