gateway: the dns01 migration path in the README restores the ambiguity, not termination #4197

Split out of the review of #3342, carried as a follow-up rather than blocking the release.

packages/extra/gateway/README.md offers three ways forward for anyone depending on the terminate path for one of the shed hostnames. The second one reads as more than it delivers: "Switching certMode to dns01 or existingSecret keeps the pre-upgrade shape wholesale".

That is literally true, and the trouble is what the pre-upgrade shape actually was. rendersTLSPassthrough (internal/controller/tenantgateway/reconciler.go:94-96) excludes edge alone, and both passthrough render loops sit outside the certMode switch that ends at reconciler.go:1585. So under dns01 the tls-<svc> listeners still stand beside a wildcard terminate listener covering the same names — which is exactly the two-chains-on-one-name ambiguity the README explains elsewhere that you cannot observe from the cluster, since the pinned Cilium has no Conflicted condition.

Someone picking that path to get Gateway termination back therefore gets the undetermined race back instead, not termination. Worth saying so where the path is offered, so the three options can be compared honestly: the first (move the consumer to another hostname under the apex) is the one that actually gives up nothing.