feat(ingress): support exposure_mode for domain-less CloudFront deployments

> _Migrated from https://github.com/aws-samples/sample-open-agentic-platform/issues/11 — originally opened by @allamand on 2026-05-20T21:00:20Z._

## Context

When deploying via `appmod-blueprints` in environments without a custom domain (e.g., AWS Workshop Studio), the ALB ingress controller fails with:

```
FailedBuildModel: no certificate found for host: cnoe.io
```

This happens because ingress resources specify `host` and `HTTPS:443`, which requires an ACM certificate for the domain.

`appmod-blueprints` now supports an `exposure_mode` config (`domain` vs `cloudfront`) that conditionally renders ingresses with HTTP:80 and no host when using CloudFront. See: https://github.com/aws-samples/appmod-blueprints/pull/680

## Affected Charts

The following charts from this repo create Ingress resources that need the same conditional:

- **agent-gateway** (agentgateway ingress in `agentgateway-system`)
- **langfuse** (langfuse ingress)

## Requested Change

Add conditional rendering based on `global.exposure_mode` (passed via `valuesObject` from the parent ApplicationSet):

```yaml
{{- if eq (default "domain" .Values.global.exposure_mode) "cloudfront" }}
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80}]'
{{- else }}
alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
alb.ingress.kubernetes.io/ssl-redirect: '443'
{{- end }}
spec:
ingressClassName: platform
rules:
{{- if eq (default "domain" .Values.global.exposure_mode) "cloudfront" }}
- http:
{{- else }}
- host: {{ .Values.global.ingress_domain_name }}
http:
{{- end }}
```

## Value Propagation

The `exposure_mode` value is passed from the ArgoCD cluster secret annotation `exposure_mode` through the ApplicationSet `valuesObject`:

```yaml
valuesObject:
global:
exposure_mode: '{{default "domain" .metadata.annotations.exposure_mode}}'
```

This is already configured in `appmod-blueprints` registry (`agents.yaml`) — the charts just need to use it.

Start with the ingress templates in the agent-gateway and langfuse charts, then trace global.exposure_mode from the ApplicationSet valuesObject. Render both charts with cloudfront and the default domain mode; done means CloudFront uses HTTP:80 without a host, while domain mode retains HTTPS:443, SSL redirect, and ingress_domain_name.

Written by the indexing model from the issue text.