fix(server): add startup probe for gateway boot

[drew]

Summary

Add a Kubernetes startupProbe for the gateway StatefulSet so slow single-node boots get startup slack before liveness restarts begin.
Tighten TLS probe log handling so immediate EOF-style disconnects from TCP socket probes do not show up as misleading handshake errors.

Related Issue

Closes #409

Changes

• add configurable startupProbe values to the OpenShell Helm chart and render the probe on the gateway StatefulSet
• downgrade only UnexpectedEof TLS accept failures to debug-level logging while keeping other handshake failures at error
• add unit coverage for the TLS handshake classifier and document the startup probe behavior in the gateway architecture doc

Testing

• mise run pre-commit passes, except for the existing untracked ignored scratch/scrub.sh SPDX check failure in this workspace
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)