…TLSRoute

- Transpile Go source to Helm templates via gotohelm
- Define lightweight TLSRoute mirror types compatible with gotohelm
  (upstream Gateway API uses type aliases the transpiler cannot handle)
- Register TLSRoute in the chart Scheme for test deserialization
- Add gateway-api-tlsroute test case to template-cases.txtar
- Regenerate all generated files (CRDs, RBAC, deepcopy, schemas)

Golden test output confirms correct resource generation:
- Bootstrap TLSRoute with SNI hostname pointing to bootstrap ClusterIP service
- Per-broker TLSRoutes with interpolated hostnames pointing to per-broker services
- ClusterIP services (bootstrap + per-pod) as TLSRoute backends
- NodePort/LoadBalancer services correctly skipped in gateway mode

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Changes gateway mode from a global all-or-nothing switch to a
per-listener opt-in. Each external listener can independently set
`gateway: true` to use TLSRoute mode while other listeners remain
on NodePort/LoadBalancer. This enables gradual migration:

1. Deploy Gateway, configure external.gateway with parentRefs
2. Add a new listener with gateway: true alongside existing ones
3. Migrate clients to the new TLSRoute-based listener
4. Remove the old NodePort/LoadBalancer listener

Key changes:
- Add Gateway *bool field to ExternalListener
- ServicePorts() skips gateway-enabled listeners (NodePort/LB)
- gatewayServicePorts() only includes gateway-enabled listeners
- TLSRoutes only created for listeners with gateway: true
- advertisedHostJSON checks per-listener gateway flag
- Remove global NodePort/LB suppression guards
- Add gateway-api-migration test case showing dual-mode operation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Rename example hostnames from kafka-*-broker to redpanda-*-broker
  in test cases and golden files
- Add changie changelog entry for the Gateway API TLSRoute feature

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

All three CI failures had the same root cause: the chart's lightweight
TLSRoute type was registered in the chart's Scheme but not in the
operator's UnifiedScheme. This caused "no kind is registered for the
type redpanda.TLSRoute" errors in:
- TestFieldManagers / TestFieldManagersRegression (migration tests)
- TestControllerRBAC (controller tests)
- TestV2ResourceClient (lifecycle tests)
- kuttl (operator binary fails to start)

Fixes:
- Register TLSRoute in the operator's V2Scheme and UnifiedScheme
  via scheme.go init()
- Fix unparam lint: addTLSRouteToScheme no longer returns an
  always-nil error

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Revert protobuf files to match CI output (buf generate strips
  license headers that the license updater adds)
- Revert zz_generated_status.go import ordering to match CI
- Regenerate operator chart golden files to include the new
  gateway.networking.k8s.io/tlsroutes RBAC rule in all test cases

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Add omitempty to GatewayParentRef.Name so the zero value is omitted
  during JSON serialization, matching the generated PartialGatewayParentRef
  which uses *string with omitempty. Fixes TestHelmValuesCompat fuzz test
  that detected a round-trip mismatch: CRD emitted {"name":""} but the
  partial expected {} for an empty GatewayParentRef.

- Fix gci import ordering in zz_generated.deprecations_test.go:
  github.com/redpanda-data/common-go belongs in the third-party group.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Use direct type conversion TLSRouteParentRef(ref) instead of
field-by-field struct literal, as the linter's unconvert/gocritic
fix recommends (identical field sets allow direct conversion).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The previous commit simplified toTLSRouteParentRefs to use a direct
type conversion but did not regenerate the Helm template. The gotohelm
transpiler now emits a simpler template that just copies the ref
directly instead of field-by-field merging.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Two fixes:

1. TestHelmValuesCompat: The fuzz test generates GatewayParentRef with
   Name=nil in the partial (*string), but the CRD type uses Name string
   (always serialized). Add a fixup callback to ensure Name is always
   non-nil in the fuzz input, matching the CRD's required field behavior.
   Revert the omitempty addition on both types since Name is required.

2. Golden files: After the toTLSRouteParentRefs type conversion change,
   the template no longer emits null fields (group, kind, namespace)
   for parent refs. Regenerated golden files to match.

Verified locally:
- TestHelmValuesCompat passes 10/10 runs
- TestTemplate (all cases) passes
- golangci-lint clean

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Previous k8s:generate run reverted the import fix. Reapplying:
github.com/redpanda-data/common-go belongs in the third-party group.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>