Add managed Gateway lifecycle for routes

[willdavsmith]

Summary

• Detect Radius.Compute/routes applications using the default route recipe and reconcile Gateway API prerequisites on the target cluster.
• Install a Radius-owned Contour/Gateway stack privately by default, validate user-managed Gateways without mutation, and require explicit environment-wide opt-in for public exposure.
• Retain shared infrastructure while routes or other Contour/Gateway consumers remain, then remove only Radius-owned resources with fail-closed discovery.

Reason for change

Applications using the default routes recipe currently fail when Gateway API CRDs, a compatible controller, GatewayClass, or Gateway are missing. This adds an idempotent lifecycle that supplies those prerequisites without creating a public endpoint by default.

Fixes radius-project/ai-extensions#421

How to test

• make test-routes-gateway test-extension-action-shell-syntax
• shellcheck --rcfile .github/linters/.shellcheckrc .github/extension/actions/manage-routes-gateway/routes-gateway.sh .github/extension/actions/manage-routes-gateway/routes-gateway_test.sh
• Parse the changed action and provider workflows as YAML.
• git diff --check

File change summary

File	Summary of change
.github/extension/actions/manage-routes-gateway/*	Adds the provider-neutral ensure/cleanup lifecycle and hermetic regression suite.
.github/extension/run-rad-commands-{azure,aws}.yml	Wires route detection and Gateway setup before deployment with environment-scoped serialization.
.github/extension/delete-{azure,aws}.yml	Cleans up unused owned Gateway infrastructure after successful application deletion.
.github/extension/README.md	Documents managed, BYO, exposure, ownership, and cleanup behavior.
build/test.mk	Adds the Gateway lifecycle suite to the repository test gate.

Companion change

• Document managed Gateway lifecycle for routes ai-extensions#570 updates the shipped Radius skill guidance and release notes.

[willdavsmith]

Closing as a duplicate of #12854, which contains the same commit and is owned by the implementation session.

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	000e374
Unique ID	func491616f3ee
Image tag	pr-func491616f3ee

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func491616f3ee
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func491616f3ee
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func491616f3ee
• controller test image location: ghcr.io/radius-project/dev/controller:pr-func491616f3ee
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func491616f3ee
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
❌ corerp-cloud functional test failed. Please check the logs for more details
✅ ucp-cloud functional tests succeeded