SecurityPolicy reports Merged: True but the merged JWT filter is not enforced

**Title:** SecurityPolicy reports `Merged: True` but the merged JWT filter is not enforced

**Version:** Envoy Gateway v1.8.3, Gateway API v1, Envoy `distroless-v1.38.3`

A Gateway-level SecurityPolicy with `jwt` + `authorization`, and a route-level SecurityPolicy with
`oidc` and `mergeType: JSONMerge` targeting an HTTPRoute on that Gateway.

Status on the route-level policy reports the merge succeeded:

```
ancestors:
- ancestorRef: {name: eg-external}
conditions: [{type: Merged, status: "True"}, {type: Accepted, status: "True"}]
```

**Expected:** merged config — OIDC plus the Gateway's JWT authentication and authorization rules.

**Actual:** the JWT filter is absent from that route's chain. A request with no token gets a 302 to
the OIDC provider instead of 401. A request with a deliberately **malformed** token also gets 302,
which rules out "JWT ran and passed":

| Route | Route-level policy | No token | Malformed token |
| --- | --- | --- | --- |
| `app-a` (control) | none | `401 Jwt is missing` | `401 Jwt header is an invalid JSON` |
| `app-b` | `oidc` + `mergeType: JSONMerge` | `302` to IdP | `302` to IdP |

Both routes are on the same Gateway and the same Gateway-level SecurityPolicy.

`mergeType: StrategicMerge` behaves the same (no `Merged` condition is reported in that case).

**Impact:** the Gateway-level JWT policy is a fail-closed backstop — it is what makes a
misconfigured upstream authenticator fail safe. `Merged: True` with no enforcement makes that
silently untrue for any route that also wants OIDC, and nothing in the status surfaces it.

**Question:** is `oidc` + `jwt` on one route an unsupported combination? If so, the policy should
be rejected rather than reported as merged.

Start by reproducing the Gateway-level and route-level SecurityPolicy combination described for app-a and app-b, comparing JSONMerge and StrategicMerge behavior. Trace how the merged policy is translated into the route filter chain and status conditions; done means either the JWT filter is enforced alongside OIDC or the unsupported combination is rejected instead of reported as merged.

Written by the indexing model from the issue text.