Wire Egress v1 platform deployment and trust bootstrap

[casey-brooks]

Scope

Wire the Egress v1 control plane and data plane into local/platform bootstrap.

Required changes

• Install cert-manager prerequisites for the platform Egress CA.
• Apply ClusterIssuer/Certificate resources to materialize the egress-ca Secret in the platform namespace.
• Deploy egress-rules and egress-gateway charts in the correct order.
• Ensure the gateway mounts egress-ca and its Ziti identity.
• Apply OpenZiti static bind policy and egress-gateway-hosts role attribute for gateway identity.
• Validate workload NetworkPolicy template wiring remains compatible with Egress v1.

Acceptance

• Bootstrap produces the required Egress v1 Kubernetes and Ziti resources.
• E2E acceptance in agynio/e2e covers the deployed flow.

Linked to agynio/architecture#152.
Related: agynio/ziti-management#60, agynio/egress#3, agynio/egress-gateway#1.