gateway: ListenerSet hostnames escape the hostname admission policy #4066

Describe the bug
cozystack-gateway-hostname-policy (packages/system/cozystack-basics/templates/gateway-hostname-policy.yaml:17) matches resources: ["gateways"] only. The vendored bundle also serves listenersets.gateway.networking.k8s.io, and a ListenerSet carries spec.listeners[].hostname, the field the policy constrains on a Gateway. A ListenerSet in a tenant namespace can declare any hostname without the policy seeing it.

Nothing is reachable today: Gateway.spec.allowedListeners.namespaces.from defaults to None and the TenantGateway controller does not set it, Cilium 1.19 does not implement ListenerSet, and no tenant ClusterRole grants the gateway.networking.k8s.io group. The gap is in the invariant the policy set claims.

Environment

• Cozystack main, 2026-09-04

To Reproduce

1. List the resources of every cozystack-*-hostname-policy
2. Compare with the served kinds carrying a hostname: gateways, httproutes, tlsroutes, grpcroutes (after feat(gateway): update the CRD bundle to Gateway API v1.6.1 and gate GRPCRoute hostnames #3872), listenersets

Expected behaviour
Every served kind with a hostname field is covered by a policy or listed as excluded, with the reason.

Actual behaviour
listenersets is neither.

Additional context
Either a rule mirroring the Gateway one, or the exclusion recorded next to the coverage guard in hack/route-hostname-policy-version-coverage.bats, so it comes back up when Cilium implements ListenerSet or allowedListeners gets enabled.

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs