[Story]: Unblock the aii-eg ArgoCD sync — Gateway API CRD admission policy and storedVersions mismatch

## Summary
The ArgoCD `aii-eg` Application's sync has failed for approximately 2 weeks, but this is masked because ArgoCD reports `Health: Healthy` (the running workload is fine — it's the manifest reconciliation that's broken). A `ValidatingAdmissionPolicy` named `safe-upgrades.gateway.networking.k8s.io` rejects experimental-channel Gateway API CRDs (`referencegrants`, `listenersets`) layered on top of standard-channel CRDs, and a separate `storedVersions` mismatch blocks updating `tcproutes`/`udproutes`.

## Intent / Source of truth
Live finding from the 2026-08-13 cluster audit (`kubectl --context admin@homeos -n argocd get application aii-eg` showing stale `Sync: OutOfSync`/failed operation despite `Health: Healthy`; `kubectl get validatingadmissionpolicy safe-upgrades.gateway.networking.k8s.io` and CRD `storedVersions` inspection).

## Scope
- [ ] Diagnose and resolve the `safe-upgrades.gateway.networking.k8s.io` admission-policy rejection for `referencegrants`/`listenersets` (align CRD channel expectations or adjust the policy/exemption)
- [ ] Fix the `storedVersions` mismatch on `tcproutes`/`udproutes` so CRD updates apply cleanly
- [ ] Confirm `aii-eg` returns to a healthy Synced state

## Out of scope
- Upgrading the Gateway API CRD channel/version itself unless required to resolve the mismatch
- Any change to `eg` workload behavior — this is a manifest-reconciliation fix only

## Verification
`kubectl --context admin@homeos -n argocd get application aii-eg` reports `Sync: Synced`; a deliberate no-op CRD change (e.g. a label bump on one Gateway API CRD) applies cleanly through ArgoCD without being rejected by the admission policy.

## Risk assessment
Currently any intended Gateway API CRD change silently fails to apply, which could mask a future real config regression. Fixing it touches cluster-scoped CRDs and an admission policy — test the no-op change carefully before relying on it for a real change.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation. A human owns intent, verification and consequences; acceptance criteria must be verified against the live system before this is closed.

Start with kubectl --context admin@homeos -n argocd get application aii-eg and inspect the safe-upgrades.gateway.networking.k8s.io ValidatingAdmissionPolicy plus storedVersions for the tcproutes and udproutes CRDs. Trace the related Gateway API CRD manifests in the Helm configuration and verify the admission and version findings against the live cluster. Done means a no-op CRD change applies through ArgoCD and aii-eg reports Sync: Synced.

Written by the indexing model from the issue text.