Everything-is-an-app cutover: Ingress/DNS/TLS group (istio, kubernetes-gateways, external-dns)

## Parent

linode/apl-core#3515

## What to build

Cut the **Ingress / DNS / TLS** group of core apps over to the new git-driven layout, applying the pattern proven on the pilot. These apps are grouped because they share the same cross-cutting managed settings beyond the universal four (`useORCS`, `nodeSelector`, `version`, `globalPullSecret`): `cluster.domainSuffix`, ingress `entrypoint`, and the derived TLS secret.

Apps in this batch:
- `istio` (its 5 chart releases, each getting its own `env/values///` triple)
- `kubernetes-gateways`
- `external-dns`

(`cert-manager` is already migrated by the pilot + artifacts slices.)

End-to-end behavior per app: `enabled` moves into `env/settings/apps.yaml`; vendor-shaped `values.custom.yaml` + operator-rendered `values.managed.yaml` land under `env/values///`; a multi-source `Application` CR file is generated under `env/manifests/namespaces/argocd/applications/`; the app's legacy `env/apps/.yaml` entry and inline-values path are removed. Any `-artifacts` releases in this group are split to git manifests per the artifacts slice.

## Acceptance criteria

- [ ] Each app in the batch reconciles Healthy in ArgoCD sourced from `env/values///{managed,custom}.yaml` via multi-source valueFiles.
- [ ] istio's 5 chart releases each have their own value dir and `Application` file.
- [ ] Shared cross-cutting values (`domainSuffix`, `entrypoint`, TLS secret) are emitted into each app's `values.managed.yaml`, not hand-copied into custom.
- [ ] Legacy `env/apps/.yaml` entries and inline-values path removed for this batch.
- [ ] Existing `installed:` gating still works from `env/settings/apps.yaml`.

## Blocked by

- linode/apl-core#3571
- linode/apl-core#3572
- linode/apl-core#3573

Start by reading the pilot migration and the existing env/apps/.yaml entries, then inspect env/settings/apps.yaml and the env/values/// layout. Apply the established pattern to istio, kubernetes-gateways, and external-dns after the listed blockers are complete. Done means each release has managed and custom values plus a multi-source Application, reconciles Healthy in ArgoCD, and has no legacy inline-values entry.

Written by the indexing model from the issue text.