Drew Newberry 2d85338940 feat(platform): cleanup api surface area and mtls flows (!39) ...

Closes #48, #52

## Summary
- Replace the envoy-gateway-based TLS setup with inline PKI generation during cluster bootstrap, generating CA, server, and client certificates directly in the `navigator-bootstrap` crate
- Remove all envoy gateway Helm templates (`gateway.yaml`, `gatewayclass.yaml`, `grpcroute.yaml`, PKI job, traffic policies) and the `Dockerfile.pki-job`
- Add native mTLS support to the navigator server with `tokio-rustls`, mounting client TLS certs as volumes into sandbox pods
- Update cluster entrypoint, healthcheck, and deploy scripts to work with the new direct-TLS architecture
- Add TLS security e2e test and fix formatting/clippy warnings

## Test Plan
- All unit tests pass (`cargo test --workspace`)
- Clippy clean (`cargo clippy --workspace --all-targets`)
- Format clean (`cargo fmt --all -- --check`)
- Python tests pass (`uv run pytest python/`)
- Full `mise run pre-commit` passes

2026-02-24 11:33:33 -08:00

..

docker

feat(platform): cleanup api surface area and mtls flows (!39)

2026-02-24 11:33:33 -08:00

helm/navigator

feat(platform): cleanup api surface area and mtls flows (!39)

2026-02-24 11:33:33 -08:00

kube/manifests

feat(platform): cleanup api surface area and mtls flows (!39)

2026-02-24 11:33:33 -08:00