[lukepolo]

Three related changes to how the panel serves traffic and keeps its images current, in one PR so they merge together. Refs #717.

Traefik binds the host's ports (was #728)

• Traefik binds the host's ports itself instead of sitting behind k3s ServiceLB. ServiceLB masquerades every request to its own pod address whenever traffic arrives on an address other than the node's InternalIP (k3s on a VPN or private node IP).
• Traefik's Service is ClusterIP. install_traefik sets hostPort from HTTP_PORT/HTTPS_PORT, rollouts replace the pod in place, and a new Traefik image is pulled onto its node before the rollout.
• An install still on ingress-nginx stays behind ServiceLB for the handover, then move_traefik_to_host_ports moves it onto the ports (update.sh, dev.sh).
• Gateway tests reach the node on an address that isn't its InternalIP, and a new job takes a ServiceLB install through the move.

On k3s 1.37 and later, the Gateway API CRDs are left to k3s

• From 1.37 k3s installs the Gateway API CRDs itself, as its gateway-api-crd chart, even with --disable=traefik, and takes them from any other release. A fresh install on 1.37 failed with "belongs to the Helm release gateway-api-crd".
• gateway-crds 0.2.0 adds a gatewayApi value. Where k3s's chart exists, install_traefik installs it with gatewayApi: false, so only Traefik's CRDs are installed. On older k3s nothing changes.
• A panel that k3s was upgraded under hands its Gateway API objects to k3s on the next update.sh. They're marked helm.sh/resource-policy: keep first: without that, Helm deletes the safe-upgrades policy when the release drops it, and k3s doesn't recreate it. If k3s's chart is later turned off, gateway-crds takes the objects back.
• Gateway tests run on k3s 1.37.2. K3S_BEFORE_GATEWAY_API (1.36.5) covers the ingress-nginx upgrade and the new k3s_upgrade_test.sh, which upgrades k3s in place on the same datastore the way rancher/k3s-upgrade does.

Images update themselves (was #729)

• A weekly workflow moves the pinned third-party images to their newest releases. Minor and patch releases go into one PR that merges itself once its checks pass. Each major release (or, below 1.0, a new second number) gets its own PR, assigned to me with a checklist and its branch-release channel. Closing that PR skips the release.
• .github/scripts/image_updates.sh keeps a tag's v, its number of version parts and its suffix (-alpine, -pg18), so prereleases and other builds never match. A pinned digest is re-pinned to the new tag's. cert-manager, the system-upgrade-controller's vendored files and the TimescaleDB test fixtures only move by hand.
• Branches and PRs come from the 5Stack Ops app (now with Contents and Pull requests write), so their checks and branch releases run. It was tested from feature: minor and patch image releases merge themselves once their checks pass, and each major release opens a PR to review #729: it opened chore: hasura/graphql-engine v2.51.4-ce.cli-migrations-v3, python 3.15.2-alpine3.24, rancher/k3s v1.37.2-k3s1 and rustfs/rc v0.1.37 #730 and left it open, assigned, when the gateway tests failed on k3s 1.37, which this PR fixes.

kustomize downloads

• setup_kustomize downloads kustomize 5.8.3's release archive and checks it against the sha256 its release published. Kustomize's install script looked the release up through GitHub's API, which refuses after 60 anonymous requests an hour per address. That failed gateway jobs on shared CI runners, and since its exit status was ignored, the job only failed later, when the binary was missing. The old comment's claim that the script verified a checksum wasn't true.

Notes

• Merging publishes gateway-crds 0.2.0, which codepier needs before it can skip the Gateway API CRDs on k3s.
• The gateway chart's defaults are now ClusterIP with no host ports, and install_traefik sets the ports. Its published version stays 0.1.0, so codepier, the only other consumer and one that installs it with default values, is unaffected. The next time gateway's version is bumped, codepier has to pass ports, or the defaults need to work without the panel.
• [Infrastructure] Real client IPs on self-hosted installs (ServiceLB hides the source address) #717 also needs the api's Cloudflare-range check (step 2), which must ship after this.