HTTPS and TLS listeners on the same port

*Description*:
The following `Gateway`:

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: default-external-gateway
namespace: gateway-system
spec:
gatewayClassName: external
listeners:
- allowedRoutes:
namespaces:
from: All
name: http
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: All
name: https
port: 443
protocol: HTTPS
tls:
certificateRefs:
- group: ""
kind: Secret
name: external-certificate
mode: Terminate
- allowedRoutes:
namespaces:
from: All
hostname: tls-test.domain.local
name: tls-1
port: 443
protocol: TLS
tls:
mode: Passthrough
```
causes the error messages in envoy pod:

```
[2026-07-17 07:33:17.467][1][warning][config] [source/extensions/config_subscription/grpc/grpc_subscription_impl.cc:138] gRPC config for type.googleapis.com/envoy.config.listener.v3.Listener rejected: Error adding/updating listener(s) gateway-system/default-external-gateway/https: error adding listener '0.0.0.0:10443': filter chain 'EmptyCluster' has the same matching rules defined as 'gateway-system/default-external-gateway/https'. duplicate matcher is: {}
```
The environment:
EnvoyGateway v1.8.2
Envoy v1.38.3
K8S v1.35.0

[*Relevant Links*:]
IT looks similar to [issue](https://github.com/envoyproxy/gateway/issues/7866)

Start by reproducing the shown Gateway configuration on Envoy Gateway v1.8.2 and inspect the generated Envoy listener and filter-chain configuration for port 443. Trace how the HTTPS and TLS listeners are translated, then verify that both can coexist without the duplicate-matcher rejection shown in the Envoy pod logs.

Written by the indexing model from the issue text.