test: add a validation for single-cluster multi-gateway routing

[nerdalert]

Summary

Adds a first-class integration test for running multiple Praxis gateways within one Kubernetes cluster and one Grid site.

The topology contains:

• One Kind cluster
• One Grid operator
• One GridNetwork
• One GridSite named single
• Two independent consumer gateways
• Three independent provider gateways
• Three attributed vLLM VCR simulator backends
• One restricted qualification client

This complements the existing multi-cluster provider-traffic qualification. It validates shared-site gateway behavior without claiming WAN, cross-cluster, or multi-site SWIM coverage. In this scenario the grid monitors the health. In the example I adjusted it down to 10s as an example of how to tune in a same-site scenario.

What This Proves

The qualification verifies:

• Exact local images are loaded before deployment
• Ordered Forge stack deployment
• Deployment readiness and observed-generation convergence
• Identical three-provider overlays for both consumers
• Grid accepted revisions match each consumer's serving revision
• Independent A/B/C round-robin selection through each consumer
• Trusted provider attribution on every measured response
• Provider withdrawal after backend endpoint removal
• Continued routing through eligible providers during withdrawal
• Provider restoration and overlay reappearance
• Consumer failure and recovery
• Concurrent traffic through both consumers
• Participation by all three providers during concurrent traffic
• Positive consumer-path access
• NetworkPolicy denial of direct backend access
• Bounded automatic cleanup

Round-robin cursors are intentionally validated independently because provider-selection state is local to each Praxis process. The qualification does not require a globally interleaved sequence across
consumer replicas.

Documentation

Adds documentation covering:

• The one-cluster, one-site architecture
• Mermaid topology and request-decision diagrams
• Configuration ownership
• Exact image build and naming requirements
• Required tools and preflight validation
• Execution and evidence commands
• Expected results and cleanup behavior
• Explicit scope and non-goals

The qualification is also linked from the shared integration-testing documentation.

Validation

Static validation passed:

• cargo +nightly-2026-03-28 fmt --all -- --check
• cargo clippy -p xtask --all-targets -- -D warnings
• cargo test -p xtask — 501 passed
• make lint
• make test
• make doc
• git diff --check
• Forge configuration validation

A fresh Kind qualification passed all runtime scenarios, including overlay and serving-revision agreement, independent round-robin routing, withdrawal and restoration, consumer recovery, concurrent attributed
traffic, NetworkPolicy controls, and automatic cleanup.

Generated runtime evidence is intentionally excluded from the commit.

Scope

This PR adds qualification infrastructure, topology configuration, and documentation only. It does not change production Grid routing behavior or modify Praxis AI.