[Story]: Unblock the aii-eg ArgoCD sync — Gateway API CRD admission policy and storedVersions mismatch

## Summary
The ArgoCD `aii-eg` Application's sync has failed for approximately 2 weeks, but this is masked because ArgoCD reports `Health: Healthy` (the running workload is fine — it's the manifest reconciliation that's broken). A `ValidatingAdmissionPolicy` named `safe-upgrades.gateway.networking.k8s.io` rejects experimental-channel Gateway API CRDs (`referencegrants`, `listenersets`) layered on top of standard-channel CRDs, and a separate `storedVersions` mismatch blocks updating `tcproutes`/`udproutes`.

## Intent / Source of truth
Live finding from the 2026-08-13 cluster audit (`kubectl --context admin@homeos -n argocd get application aii-eg` showing stale `Sync: OutOfSync`/failed operation despite `Health: Healthy`; `kubectl get validatingadmissionpolicy safe-upgrades.gateway.networking.k8s.io` and CRD `storedVersions` inspection).

## Scope
- [ ] Diagnose and resolve the `safe-upgrades.gateway.networking.k8s.io` admission-policy rejection for `referencegrants`/`listenersets` (align CRD channel expectations or adjust the policy/exemption)
- [ ] Fix the `storedVersions` mismatch on `tcproutes`/`udproutes` so CRD updates apply cleanly
- [ ] Confirm `aii-eg` returns to a healthy Synced state

## Out of scope
- Upgrading the Gateway API CRD channel/version itself unless required to resolve the mismatch
- Any change to `eg` workload behavior — this is a manifest-reconciliation fix only

## Verification
`kubectl --context admin@homeos -n argocd get application aii-eg` reports `Sync: Synced`; a deliberate no-op CRD change (e.g. a label bump on one Gateway API CRD) applies cleanly through ArgoCD without being rejected by the admission policy.

## Risk assessment
Currently any intended Gateway API CRD change silently fails to apply, which could mask a future real config regression. Fixing it touches cluster-scoped CRDs and an admission policy — test the no-op change carefully before relying on it for a real change.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation. A human owns intent, verification and consequences; acceptance criteria must be verified against the live system before this is closed.