HYPERFLEET-1485 - test: add gateway authentication e2e suite

[kuudori]

TL;DR

Add make check-gateway-e2e, a repeatable kind suite that exercises the gateway authentication boundary across human and machine callers, API tenant isolation, Sentinel/adapter reconciliation, tenant-model switching, and Cilium NetworkPolicy enforcement.

What changed

• Add scripts/check-gateway-e2e.sh with focused human and current-model phases plus the full on-prem-to-Oracle run.
• Check missing and invalid credentials, missing tenant claims, forged identity and tenant headers, ServiceAccount authorization, tenant isolation, lifecycle reconciliation, and direct API access blocked by NetworkPolicy.
• Configure Sentinel and adapter requests to use the ServiceAccount scheme when gateway auth is enabled, and order the mock OIDC release before the gateway.
• Add Make targets and README instructions for setup and repeatable runs.

Verification

• bash -n scripts/check-gateway-e2e.sh and git diff --check pass.
• The full suite has not been run here; it requires a running kind deployment with Cilium and mock OIDC. (Waiting for HYPERFLEET-1484)

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign pnguyen44 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (2)

• do-not-merge/work-in-progress
• do-not-merge/hold

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 848ff868-a98c-4bc8-a0d8-59ca6ba6dace

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}