feat(helm): support agentgateway ingress

Problem Statement

OpenShell documents and tests Envoy Gateway as its Kubernetes Gateway API implementation. Operators using agentgateway lack a supported setup, and simply setting grpcRoute.gateway.className=agentgateway is unsafe: agentgateway names its generated Service after the Gateway, which collides with OpenShell's default openshell Service name.

Proposed Design

Keep the Helm chart controller-neutral and manage agentgateway separately as cluster infrastructure.

• Document a production path that attaches OpenShell's GRPCRoute to a shared agentgateway Gateway.
• Support a dedicated chart-created Gateway for development when it has a non-conflicting name.
• Add an optional parent listener sectionName for shared Gateways.
• Generalize Envoy-specific chart text without changing the existing eg default.
• Add agentgateway values, setup tasks, troubleshooting guidance, and a Kubernetes E2E test that runs OpenShell CLI and sandbox operations through the agentgateway data plane.
• Preserve the current TLS model: agentgateway terminates TLS and OpenShell validates OIDC bearer tokens.

Alternatives Considered

• Documentation-only class override: rejected because of the Service name collision and lack of runtime coverage.
• Bundling agentgateway with the OpenShell chart: rejected because cluster-scoped CRDs and controller lifecycle should remain platform-owned.
• TLS/TCP passthrough: deferred because it loses gRPC-aware routing and expands the chart surface.

Agent Investigation

The existing Gateway and GRPCRoute templates are portable. Agentgateway supports both resources and HTTPS listeners, but its generated data-plane resources use the Gateway name. The recommended shared-Gateway model avoids that collision and keeps agentgateway-specific policy resources outside the OpenShell chart.

Checklist

• I've reviewed existing issues and the architecture docs
• This is a design proposal, not a "please build this" request

Start with the existing Helm Gateway and GRPCRoute templates, Envoy Gateway documentation and tests, and the Kubernetes E2E test entry points mentioned in the issue. Define the agentgateway values, shared or dedicated Gateway setup, sectionName support, documentation, troubleshooting, and CLI/sandbox E2E coverage; done means agentgateway routes work without the Service-name collision while the existing eg default remains unchanged.