remove non mitm dataplanes - #2015

… only one

Two envoy egress gateways could be installed: the plain one by default,
which forwarded tunnelled TLS untouched and so could decide it by address
only, and behind --experimental-use-sdsmint the terminating one, which
mints a per-SNI leaf, reads every request and decides it by name. Hostname
rules for HTTPS and credential injection only ever existed on the second,
and every deployment that wanted them had to opt in. With the agentgateway
egress already always minting, the terminating gateway is now the only one
on both dataplanes, and the flag is gone from ate-setup, the shell shim and
the benchmark automation.

Envoy keeps atenet-egress-with-sdsmint.yaml; atenet-egress.yaml is
deleted. The remaining manifest gains the dual-stack sockets the plain one
got in 5012abf, which left the sdsmint variant IPv4-only.

The e2e job installs the gateway once, with credential injection enabled
on envoy through ATE_CREDENTIAL_INJECTION_ENABLED, instead of redeploying
it for six more lanes. The identity suite now runs last, on its own: it
replaces the egress CA pool to prove the projected trust bundle follows
it, and the gateway picks a rotation up only once kubelet has propagated
the Secret into its pod, so for a while after each rotation it signs with
a CA no actor trusts. That never mattered while the plain gateway ignored
the pool and the sdsmint lanes ran after the rotations were over; with one
gateway it would fail whatever TLS test ran alongside.

E2E_EGRESS_MITM selected the gateway variant for the networking and
egressmitm suites and is gone with it; the tests it gated always run. The
shell twin of the injection splice,
hack/experimental-egress-credential-injection.sh, has been sourced by
nothing since install-ate.sh became a shim, and is removed rather than
updated.

…gress gateway

With the plain gateway gone, "the sdsmint gateway", "the MITM gateway" and
the -with-sdsmint and -mitm names distinguished nothing. The envoy manifest
is atenet-egress.yaml again, the agentgateway overlay and its component are
agentgateway-egress, and comments, docs and test names say "the egress
gateway" or "the gateway". sdsmint stays where it is the thing being
configured: its package, the sidecar container and its volumes in the envoy
manifest, and the kustomize patch that removes them for agentgateway.

The egress demos lose their -mitm variants the same way. The plain egress
and egress-microvm demos trusted only public roots, which nothing behind
the gateway chains to, so they could no longer do HTTPS; the -mitm
variants, which project the gateway's trust bundle, are now the egress
demos under the plain names, and the e2e fixtures and the CI deploy step
follow. The egress-mitm-ca-pool Secret, the egress-mitm.ate.dev bundle and
the EgressMITMTrust reconciler keep their names: they name the CA, not a
variant.