[fiunchinho]

Fixes #100

Problem

The egress gateway dials the upstream of an https rule with the image's public roots only, so an upstream behind a private CA (for example an in-cluster model gateway) fails with UnknownIssuer. Setting backendTLS.root to the private CA replaces the public roots.

Change

• atenetEgress.upstreamTrust.caBundle renders a PEM bundle as the ConfigMap <release>-atenet-egress-upstream-trust.
• The agentgateway container mounts it at /run/egress-upstream-trust and sets SSL_CERT_DIR to that path, beside SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt.
• With a bundle set, the dynamic HTTPS backend renders backendTLS: {} without root, so agentgateway builds its roots from rustls-native-certs, which loads both locations.
• checksum/upstream-trust on the pod template rolls the gateway when the bundle changes.
• Empty by default. The default render is byte-identical to main.

Testing

helm unittest charts/substrate
helm lint charts/substrate
helm template rel charts/substrate --output-dir out-default
helm template rel charts/substrate -f bundle-values.yaml --output-dir out-bundle

• helm unittest: 44 of 44 tests pass. charts/substrate/tests/atenet_egress_upstream_trust_test.yaml covers both cases: root: /etc/ssl/certs/ca-certificates.crt on the dynamic backend by default, and backendTLS: {} with no reference to the image bundle in the gateway config when a bundle is set. The second case fails without the root change.
• helm lint: 0 charts failed.
• diff -r of the default render against a render of main: no differences.
• With a bundle: the dynamic backend has backendTLS: {}, the container has SSL_CERT_FILE and SSL_CERT_DIR=/run/egress-upstream-trust, and the ConfigMap, volume, mount and checksum annotation are present.

The change was prepared with an AI coding agent (cherry-pick, conflict resolution, the root change and the chart tests). I reviewed the diff and the rendered output.