`ingress-nginx` deprecation and migration

Kubernetes is [retiring ingress-nginx](https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/) to encourage cluster admins to migrate to the [Gateway API](https://kubernetes.io/docs/concepts/services-networking/gateway/).

We should migrate too, but we use a lot of helm charts that will still expect the Ingress API to be available. And we need to be able to migrate applications over one by one.

A company called [Chainguard has forked ingress-nginx](https://www.chainguard.dev/unchained/keeping-ingress-nginx-alive) to provide a maintenance version in which they will provide software updates and security patches on a best-effort basis, so we can switch our ingress to use their images.

Afterwards we should pick [one of the Gateway API providers](https://gateway-api.sigs.k8s.io/implementations/) and migrate our Ingresses over. Some options that look decent:
- [NGINX Gateway Fabric](https://gateway-api.sigs.k8s.io/implementations/#nginx-gateway-fabric) - same nginx backend we currently use, only for Gateway API, Ingress will need a separate deployment like [F5 NGINX Ingress Controller](https://docs.nginx.com/nginx-ingress-controller) from the same vendor [ [docs](https://docs.nginx.com/nginx-gateway-fabric) ]
- [HAProxy Ingress Controller](https://gateway-api.sigs.k8s.io/implementations/#haproxy-kubernetes-ingress-controller) - seems to support both Gateway and Ingress resources with 1 deployment [ [docs](https://www.haproxy.com/documentation/kubernetes-ingress/gateway-api/enable-gateway-api/) ]
- [Traefik Proxy](https://gateway-api.sigs.k8s.io/implementations/#traefik-proxy) - Also supports both Gateway and Ingress resource, supports many of the ingress-nginx annotations for easy migration [ [docs](https://doc.traefik.io/traefik/v3.6/reference/install-configuration/providers/kubernetes/kubernetes-gateway/) ]

Start by inventorying the Helm charts and Ingress resources that depend on ingress-nginx, then compare the listed Gateway API providers against those requirements. Done means a provider and migration approach are selected, including how Ingress and Gateway resources can coexist during the application-by-application migration.

Written by the indexing model from the issue text.