tenant Gateway: two small ordering and gating items in the reconciler #4198

Split out of the review of #3342, carried as follow-ups. Two small items, both in internal/controller/tenantgateway/reconciler.go, neither urgent.

The recount gate declines to fix a false conflict the machinery is already there for. recount (reconciler.go:325-337) re-ranks ownership of a hostname over the plain routes plus whichever field it is given, and it runs only under if len(refused) > 0 (:341-344). So an ordinary race with no refusal keeps the original ranking, and that ranking is wrong for one shipped case: cert-manager's HTTP-01 solver route is published in the Gateway's own namespace with sectionName: http (renderers.go:823-825), so it counts as served-plain and enters the race; rankRouteRefs orders by namespace, and tenant-a sorts before tenant-a-child. A child tenant publishing a hostname therefore loses the race to the solver for the duration of every ACME challenge and reads Accepted=False with HostnameConflict, while its terminate listener is rendered and being served. The outcome is the same on the merge base, so this is a pre-existing symptom rather than a regression — but recount already does exactly the right thing, so it is one condition away. Either drop the gate for this case or leave a comment saying why the solver is allowed to win.

The withdrawal reads namespace state one pass before it establishes it. collectHostnameClaims runs at reconciler.go:187 and ensureNamespaceLabels at :652, so on the first reconcile after an entry is added to attachedNamespaces a route in that namespace is judged attachable while the Gateway's own selector does not yet admit it. It converges on the next pass, so the worst case is one pass of a status condition that is briefly wrong rather than anything served incorrectly — but a withdrawal decision taken from state the same function has not yet written is worth either reordering or naming in a comment.