Move operator to aigateway.envoyproxy.io/v1beta1 and update examples to Envoy Gateway v1.8.3 / AI Gateway v1.1.0

Problem

The operator writes six objects as aigateway.envoyproxy.io/v1alpha1 (reconcilers/routing.go, reconcilers/passthrough.go). Envoy AI Gateway v0.6.0 promoted AIGatewayRoute, AIServiceBackend and BackendSecurityPolicy to v1beta1; v1.x serves v1alpha1 only as deprecated (deprecated: true, storage: false), so every write emits a deprecation warning and the version will be dropped in some later release.

examples/envoy-ai-gateway.yaml and examples/envoy-gateway.yaml still pin ai-gateway v0.5.0 and Envoy Gateway v1.6.2. ai-gateway v0.5.0 has a controller crash loop that freezes config for every service on a shared gateway (nil dereference in PostRouteModify when the InferencePool controller has not synced yet; fixed in https://github.com/envoyproxy/ai-gateway/pull/1951, first released in v0.6.0). We should not be recommending it.

Compatibility already verified

A customer is bumping to Envoy Gateway v1.8.3 and ai-gateway v1.1.0 without any pack change (https://github.com/Concepts-NREC/Nebari-GitOps/pull/87, https://github.com/Concepts-NREC/Nebari-GitOps/pull/88, https://github.com/Concepts-NREC/Nebari-GitOps/pull/89). This is safe because:

• v1alpha1 is still served by v1.1.0.
• The two v0.6 breaking changes do not apply: the operator never sets AIGatewayRoute.spec.filterConfig, and schema.version is only emitted for PassthroughModel (as v1, not a path prefix).
• The operator does not use EnvoyPatchPolicy or an OIDC SecurityPolicy, the EG v1.7/v1.8 changes that affect extension users.
• ai-gateway v1.1.0 reads InferencePool via GIE v1.0.2 client while we install GIE v1.5.0 CRDs; both are the stable inference.networking.k8s.io/v1 API.

Fix

1. Change the six apiVersion literals to aigateway.envoyproxy.io/v1beta1 and the RBAC marker if needed. Keep the field set identical; nothing we set changed shape.
2. examples/: Envoy Gateway v1.6.2 → v1.8.3, ai-gateway CRDs and controller v0.5.0 → v1.1.0. Add extensionManager.failOpen: true and controller.leaderElection.enabled: false (single replica) with a comment explaining the crash-loop window; see the customer PRs above for wording.
3. Document the tested version triple (Envoy Gateway / AI Gateway / GIE CRDs) in the README so the ordering across NIC and the pack is written down somewhere.
4. Note in the changelog that the pack was verified on v0.5.0 and v1.1.0 so installs mid-upgrade are supported.

Start in reconcilers/routing.go and reconcilers/passthrough.go, locating the six apiVersion literals and the RBAC marker. Then update examples/envoy-ai-gateway.yaml and examples/envoy-gateway.yaml using the requested Envoy Gateway and AI Gateway versions and settings, and read the customer PRs for wording. Done means the README documents the tested version triple and the changelog records compatibility across the specified versions.