[P1] CI lost its e2e tier when the template pipeline landed

[jacaudi]

Adopting the template pipeline in #43 dropped a test tier. The pipeline it replaced ran three; the new one runs two.

What was lost

pull-request-workflow.yaml had a third job after test:

  e2e:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Build images
        env:
          MANAGER_IMAGE: wireguard-operator/manager:test
          AGENT_IMAGE: wireguard-operator/agent:test
        run: make docker-build-integration-test
      - uses: azure/setup-kubectl@v5
      - name: Run e2e tests
        run: |
          make kind
          make run-e2e AGENT_IMAGE=wireguard-operator/agent:test MANAGER_IMAGE=wireguard-operator/manager:test

That exercised internal/it behind the e2e build tag against a real kind cluster. jacaudi/template models unit (ci-lint) and envtest (ci-integration) only, and ships no e2e stage, so nothing in the new pipeline covers that tier.

Current state, verified with go test -list '.*':

tag	package	runs in CI
(none)	internal/agent, ipam, iptables	yes — ci-lint
integration	internal/controller	yes — ci-integration
e2e	internal/it	no

Why it was not simply restored in #43

internal/it's wstunnel spec is intermittently red, and the cause is a race in the test rather than a product bug — see #45. Wiring an intermittently-failing suite into ci, which is now the single required status check, would leave main randomly unmergeable. An honest gap beats a gate that cries wolf.

So this is blocked on #45. Recorded in .github/workflows/ci.yaml next to the integration job so it is visible where it matters rather than only here.

What restoring it looks like

A repo-local ci-e2e.yml stage — the template will not grow one, since no other repo in the fleet needs a cluster — wired into ci.yaml and added to the ci gate's needs. It needs kind, both images built locally (make docker-build-integration-test), and roughly the step sequence quoted above. make run-e2e still works locally today and is the way to run this tier in the meantime.

Worth deciding at the same time whether it belongs in the required gate at all, or in a scheduled run: it is the slowest tier by far, and the fleet pipeline is built around a single fast required check.

Related: #16 wants new e2e coverage for VPN egress, which needs this stage to exist to be worth writing.