e2e(gateway): switching a live Gateway to another class has no test #4069

Problem / motivation
#3861 lets a tenant pick a Gateway class and follows it for TLS termination. Unit tests cover the selection in four charts and both controllers. No layer covers the transition: reprogramming a live Gateway onto another class. Gateway.spec.gatewayClassName has no immutability rule in the shipped CRD, so the apiserver accepts the update, and what the outgoing class controller does with the LoadBalancer Service it provisioned is invisible to a static review.

Proposed solution
Two cases of different cost. The certMode transition (http01 to edge and back, class stays cilium) fits the existing gateway chainsaw suite: create the probe TenantGateway with a passthrough service, attach a TLSRoute, assert Accepted=True, patch certMode, assert the TLS listener is gone and the route reports Accepted=False. The class transition needs a second GatewayClass with a live controller; the Cloudflare Tunnel controller needs credentials and cannot be a CI dependency, so this needs a stub controller that accepts a class and never programs, as a test-only component.

Scope check

• This affects a single component / package
• I can describe the expected behavior concretely

Alternatives considered
A manual check on a cluster with a real tunnel class. Fine once, not as a regression test.

Additional context
Surfaced while reviewing #3861.