Helm: Set compatible proxy image in `global.images.envoyProxy.image`

### Description

https://github.com/envoyproxy/gateway/blob/3ab110e76778ed3f5ea9365b6f0d0753c2b2dd9c/charts/gateway-helm/values.tmpl.yaml#L28-L31

#8785 added `global.images.envoyProxy.image` to gateway-helm. Nice addition! The default value is `""`, which falls back to the `DefaultEnvoyProxyImage` Go constant baked into the controller binary.

The release process already pins image tags "in both the source code and the Helm chart" ([RELEASING.md step 9](https://github.com/envoyproxy/gateway/blob/main/site/content/en/community/RELEASING.md). For example in #8902:

- `DefaultEnvoyProxyImage` in `api/v1alpha1/shared_types.go` → `docker.io/envoyproxy/envoy:distroless-v1.38.0`
- `global.images.ratelimit.image` in `charts/gateway-helm/values.tmpl.yaml` → `docker.io/envoyproxy/ratelimit:fe26676d`

but `global.images.envoyProxy.image` is not changed.

### Why

In restricted/air-gapped environments every image must be mirrored (and often signed), and that tooling typically discovers images by scanning **rendered** manifests (`helm template` / ArgoCD). Because the Envoy proxy Deployment is created by the gateway controller at runtime, the image appears nowhere in rendered output if the Helm value is empty. In our case we have to hand-pin the proxy image and manually track the EG<->Envoy compatibility matrix on every upgrade.

With a chart default, the image appears in the rendered ConfigMap and our image tooling can it up automatically. The ratelimit image already works like this.

### Proposal

Extend the release step (RELEASING.md) to also set the compatible image version in `global.images.envoyProxy.image` in `values.tmpl.yaml`.

Or; set it while packaging the chart `${GatewayImage}`, sourced from the Go constant?

Let me know if you want a PR created for this!