gateway: the edge listener shares its allowedRoutes pointer with the apex and child listeners #4118

Describe the bug
renderGateway in internal/controller/tenantgateway/reconciler.go, case CertModeEdge: edgeAllowedRoutes := allowedRoutes.DeepCopy() is handed to the edge listener as is, while edge-apex and every edge-child-* listener receive edgeAllowedRoutes.DeepCopy(). Harmless today, since nothing mutates the value after the assignment, but it is the one place that does not follow the pattern the neighbouring branches use (passthroughAllowed := allowedRoutes.DeepCopy(), a constructor for port443Kinds) so that every listener owns its RouteNamespaces and its Kinds slice. The first edgeAllowedRoutes.Kinds = ... written after that line reaches the edge listener through the shared pointer and nothing else.

Environment

• Cozystack main, 2026-09-07 (byte-identical on the feat(gateway)!: add TLS-passthrough listeners to TenantGateway #3342 branch)

To Reproduce

1. Read the CertModeEdge branch of renderGateway

Expected behaviour
All three edge listener kinds get their own copy.

Actual behaviour
One shares the pointer.

Additional context
One-word change: AllowedRoutes: edgeAllowedRoutes.DeepCopy() on the edge listener. Surfaced by a review pass over #3342 as a pre-existing item.

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs