bug(tenant): gateway: false does not opt out of Gateway inheritance (behaves like unset) #4542

Describe the bug

tenant.spec.gateway: false does not opt a tenant out of Gateway publishing. An explicit false behaves identically to leaving the key unset: the tenant owns no Gateway of its own, but it still inherits and publishes through the nearest ancestor tenant that owns one.

This contradicts the apparent design intent. The unit test packages/apps/tenant/tests/gateway_default_test.yaml describes the false case as an "escape hatch" that opts out "even inheritance". The chart does not implement that: the assertion only checks that no own Gateway HelmRelease is rendered, which is also true for unset, so the "no inherit" intent was never actually tested.

Environment

• Component: packages/apps/tenant chart
• Version: current main

To Reproduce

helm template tenant-alice packages/apps/tenant \
  --namespace tenant-root \
  --set gateway=false \
  --set-json '_namespace={"gateway":"tenant-root","host":"example.org","ingress":"tenant-root"}' \
  --show-only templates/namespace.yaml

The rendered namespace carries namespace.cozystack.io/gateway: "tenant-root" and the injected _namespace.gateway: "tenant-root". The TenantGateway controller keys on that label, so apps in this tenant keep publishing through the parent's Gateway.

Expected behaviour

One of:

1. An explicit false parks the tenant: no own Gateway and no inheritance (_namespace.gateway empty, so the ancestor Gateway's allowedRoutes selector does not match this namespace), or
2. The tri-state is intentionally collapsed and false is defined to behave exactly like unset.

Either way the documentation and the test comment must match the chosen behaviour.

Actual behaviour

false behaves the same as unset. tenant.gatewayEffective (packages/apps/tenant/templates/_helpers.tpl:88-94) returns "false" for both an explicit false and an unset key. In packages/apps/tenant/templates/namespace.yaml (around lines 57-60) $gateway starts as $parentNamespace.gateway and is only overridden to the tenant's own name when tenant.gatewayEffective returns "true". For false it therefore keeps the parent's value, so inheritance stays on.

Additional context

Surfaced during review of #4538, which corrected the gateway parameter description to state the actual behaviour (that false currently behaves like unset) and fixed the stale comment in gateway_default_test.yaml. This issue tracks the underlying decision: implement the opt-out (option 1) or keep the collapsed behaviour and treat the tri-state as documentation-only (option 2).

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs