Failure to modify immutable infrastructure fields is not correctly processed

*Description*:
For example when modifying `service.healthCheckNodePort` through `EnvoyProxy` resource. Modifying `service.healthCheckNodePort` on `Service` is disallowed by apiserver because this is an immutable field, however envoy-gateway does not catch this scenario. envoy-gateway should catch this and recreate instead of update the `Service`. Also neither `EnvoyProxy` nor `Gateway` reflect that the infrastructure for the `Gateway` is invalid. Listeners are reported as `Programmed`. The fact that this is failing to apply can only be found in the operator logs.

*Repro steps*:
Use `EnvoyProxy` infrastructure resource in `Gateway`:

```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
name: gateway-infra
spec:
provider:
kubernetes:
envoyService:
patch:
type: StrategicMerge
value:
spec:
healthCheckNodePort: 31502
```

Change to:

```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
name: gateway-infra
spec:
provider:
kubernetes:
envoyService:
patch:
type: StrategicMerge
value:
spec:
healthCheckNodePort: 30502
```

*Logs*:

Operator:

```
2026-02-11T08:38:32.359Z ERROR infrastructure runner/runner.go:125 failed to create new infra {"runner": "infrastructure", "error": "failed to create or update service envoy-gateway/gateway: failed to create/update resource with server-side apply for obj &Service{ObjectMeta:{gateway envoy-gateway 0 0001-01-01 00:00:00 +0000 UTC map[app.kubernetes.io/component:proxy app.kubernetes.io/managed-by:envoy-gateway app.kubernetes.io/name:envoy gateway.envoyproxy.io/owning-gateway-name:gateway gateway.envoyproxy.io/owning-gateway-namespace:envoy-gateway gateway.networking.k8s.io/gateway-name:gateway] map[] [{gateway.networking.k8s.io/v1 Gateway gateway 3329f502-fbb0-4223-a1b2-5990abc5b328 }] [] []},Spec:ServiceSpec{Ports:[]ServicePort{ServicePort{Name:https,Protocol:TCP,Port:443,TargetPort:{0 10443 },NodePort:32443,AppProtocol:nil,},ServicePort{Name:http,Protocol:TCP,Port:80,TargetPort:{0 10080 },NodePort:32080,AppProtocol:nil,},ServicePort{Name:udp-23443,Protocol:UDP,Port:23443,TargetPort:{0 23443 },NodePort:0,AppProtocol:nil,},},Selector:map[string]string{app.kubernetes.io/component: proxy,app.kubernetes.io/managed-by: envoy-gateway,app.kubernetes.io/name: envoy,gateway.envoyproxy.io/owning-gateway-name: gateway,gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway,gateway.networking.k8s.io/gateway-name: gateway,},ClusterIP:,Type:LoadBalancer,ExternalIPs:[185.101.40.98],SessionAffinity:None,LoadBalancerIP:,LoadBalancerSourceRanges:[0.0.0.0/0],ExternalName:,ExternalTrafficPolicy:Local,HealthCheckNodePort:32502,PublishNotReadyAddresses:false,SessionAffinityConfig:nil,IPFamilyPolicy:nil,ClusterIPs:[],IPFamilies:[],AllocateLoadBalancerNodePorts:*false,LoadBalancerClass:nil,InternalTrafficPolicy:nil,TrafficDistribution:nil,},Status:ServiceStatus{LoadBalancer:LoadBalancerStatus{Ingress:[]LoadBalancerIngress{},},Conditions:[]Condition{},},}: Service \"gateway\" is invalid: spec.healthCheckNodePort: Forbidden: field is immutable"}
2026-02-11T08:38:32.359Z ERROR watchable message/watchutil.go:86 observed an error {"runner": "infrastructure", "error": "failed to create or update service envoy-gateway/gateway: failed to create/update resource with server-side apply for obj &Service{ObjectMeta:{gateway envoy-gateway 0 0001-01-01 00:00:00 +0000 UTC map[app.kubernetes.io/component:proxy app.kubernetes.io/managed-by:envoy-gateway app.kubernetes.io/name:envoy gateway.envoyproxy.io/owning-gateway-name:gateway gateway.envoyproxy.io/owning-gateway-namespace:envoy-gateway gateway.networking.k8s.io/gateway-name:gateway] map[] [{gateway.networking.k8s.io/v1 Gateway gateway 3329f502-fbb0-4223-a1b2-5990abc5b328 }] [] []},Spec:ServiceSpec{Ports:[]ServicePort{ServicePort{Name:https,Protocol:TCP,Port:443,TargetPort:{0 10443 },NodePort:32443,AppProtocol:nil,},ServicePort{Name:http,Protocol:TCP,Port:80,TargetPort:{0 10080 },NodePort:32080,AppProtocol:nil,},ServicePort{Name:udp-23443,Protocol:UDP,Port:23443,TargetPort:{0 23443 },NodePort:0,AppProtocol:nil,},},Selector:map[string]string{app.kubernetes.io/component: proxy,app.kubernetes.io/managed-by: envoy-gateway,app.kubernetes.io/name: envoy,gateway.envoyproxy.io/owning-gateway-name: gateway,gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway,gateway.networking.k8s.io/gateway-name: gateway,},ClusterIP:,Type:LoadBalancer,ExternalIPs:[185.101.40.98],SessionAffinity:None,LoadBalancerIP:,LoadBalancerSourceRanges:[0.0.0.0/0],ExternalName:,ExternalTrafficPolicy:Local,HealthCheckNodePort:32502,PublishNotReadyAddresses:false,SessionAffinityConfig:nil,IPFamilyPolicy:nil,ClusterIPs:[],IPFamilies:[],AllocateLoadBalancerNodePorts:*false,LoadBalancerClass:nil,InternalTrafficPolicy:nil,TrafficDistribution:nil,},Status:ServiceStatus{LoadBalancer:LoadBalancerStatus{Ingress:[]LoadBalancerIngress{},},Conditions:[]Condition{},},}: Service \"gateway\" is invalid: spec.healthCheckNodePort: Forbidden: field is immutable"}
```