fix(ci): use mapped NodePort for kind gateway sessions

[elezar]

Superseded by #4424, which now includes this CI transport fix alongside the test-selection fix. The follow-up investigation remains in #4445.

Summary

Use a localhost-mapped NodePort for direct kind Kubernetes E2E gateway connections. The SSH reconnect reproducer fails through kubectl port-forward but passes through NodePort on the same deployment; moving gateway traffic off port-forward removes that transport from the CI test path.

Related Issue

Follow-up investigation: #4445. This PR does not close that issue: delayed session/input-owner cleanup through port-forward remains unexplained.

No separate implementation issue is needed for this localized CI stability fix, under the repository's agent instructions. The conformance-selection fix in #4424 remains independent; this change does not alter suite selection.

Changes

• Allow the shared kind setup action to receive a cluster config; direct Kubernetes E2E lanes map NodePort 30080 to runner 127.0.0.1:17670.
• Configure the gateway Service as NodePort and register the mapped endpoint, including database scenarios. Overrides follow caller-supplied Helm values so the Service agrees with the kind map.
• Preserve port-forwarding for local/external clusters without the opt-in, Envoy Gateway proxy lanes, and gateway health checks. OpenShift retains its Route/mTLS path.
• Update CI documentation and gateway troubleshooting guidance.

Testing

• mise run pre-commit, including the commit hook.
• Shell syntax, ShellCheck (-x -e SC2034, excluding an existing unused-loop-variable warning), workflow actionlint, YAML parsing, and git diff --check.
• Targeted checks for mapped endpoint readiness, timeout failure, and the existing port-forward fallback.
• Helm rendering confirms the gateway Service uses NodePort 30080.
• Linux ARM64 tmachine kind v0.31.0 / Kubernetes v1.35.0 comparison with matching CI-built OpenShell images: port-forward loses the first input in 8/8 sessions; NodePort echoes it in 8/8. Validation uses this branch's kind config and actual connection helper. This is a targeted reproducer, not the complete Kubernetes E2E suite; CI is x86_64.
• Full mise run ci: attempted with fresh Go caches; Rust test linking fails because the host lacks system Z3 (ld: library 'z3' not found), as previously observed for fix(ci): restore default e2e coverage with a Kubernetes recovery waiver #4424.

Checklist

• Follows Conventional Commits.
• Commit is signed off for DCO.
• Related CI and troubleshooting guidance updated.

[github-actions]

Label test:e2e applied for 09e4ec6. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.