fix(gateway-helm): honour global.imageRegistry in the eg.image fallback

[weatherhog]

What this PR does / why we need it:

eg.image has four branches. The final fallback — reached when neither
deployment.envoyGateway.image.repository nor global.images.envoyGateway.image is set — was the
only one that did not consult global.imageRegistry:

{{- else -}}
docker.io/envoyproxy/gateway:{{ .Chart.Version }}
{{- end -}}

So a user who points the chart at a private registry and leaves the gateway image unset is silently
sent to Docker Hub, while every other image in the same render honours the override. Rendering
global.imageRegistry: private.registry with global.images.envoyGateway.image: "" on main today:

# control plane Deployment, certgen Job, and the EnvoyProxy shutdownManager:
image: docker.io/envoyproxy/gateway:v0.0.0-latest
# ratelimit, in the very same render:
image: private.registry/envoyproxy/ratelimit:master

The existing global-registry-override-deployment and global-registry-override-global cases cover
the two branches that already worked. This was the uncovered combination in that matrix, which is
how it went unnoticed, so this PR adds global-registry-override-fallback alongside them. After the
change all three eg.image sites resolve to private.registry/envoyproxy/gateway:latest.

The fallback now uses the same shape as its siblings:

{{- printf "%s/envoyproxy/gateway:%s" (default "docker.io" .Values.global.imageRegistry) .Chart.AppVersion -}}

This restores the documented contract. The airgap deployment guide already tells users that
global.imageRegistry "take[s] highest precedence and change[s] both envoyGateway and ratelimit's
container registry and pull secrets"
(site/content/en/latest/tasks/operations/airgap-deployment.md).
The fallback branch was the one place that did not keep that promise, so this PR needs no
documentation change — the docs already describe the behaviour after this fix.

Reviewer notes

• No change when global.imageRegistry is unset — the default "docker.io" preserves today's
  registry. All 34 pre-existing golden files are byte-identical; only the new case is added.
• The tag switches from .Chart.Version to .Chart.AppVersion, matching the three sibling
  branches, which already use AppVersion. Released charts ship version == appVersion (checked
  v1.6.2, v1.7.3, v1.8.1, v1.8.2, v1.9.0), so no released chart changes its tag. On main the
  rendered tag moves from v0.0.0-latest to latest; neither is a published tag of
  docker.io/envoyproxy/gateway, so nothing regresses there either. Happy to drop this half and keep
  the PR purely about the registry if you would rather not touch it.
• Sub-path registries (imageRegistry: "reg.io/sub") behave here exactly as they do in the other
  branches, i.e. they inherit the existing quirk in global.imageRegistry with sub-path causes duplicated path segments in constructed image references #8886. This PR does not change that either way.

Which issue(s) this PR fixes:

None filed. Related, but not fixed by this PR: #8886 and #8323.

---

PR Checklist

• Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
• DCO: All commits are signed off (git commit -s). See DCO: Sign your work.
• API agreed first: If this PR contains API changes (changes under /api), the API was discussed and agreed before the implementation. The API change can be in a separate PR, or in the same PR, but the API must be agreed before implementation. N/A if this PR does not contain API changes. — N/A: no changes under /api.
• Required checks pass: make generate gen-check, make lint, and the unit-test/coverage build pass. (Flaky e2e failures are not considered breakages, but gen-check, lint, and coverage MUST pass.)
• Tests added/updated: New/changed code is covered by appropriate tests. N/A if this PR does not contain code changes. — added global-registry-override-fallback, which covers the previously untested fallback branch.
• Docs: User-facing changes update the docs, either in this PR or a follow-up PR. N/A if this PR does not contain user-facing changes. — N/A: the airgap guide already documents global.imageRegistry as taking highest precedence; this change makes the code match the existing docs.
• Release notes: For any non-trivial change, added a release-note fragment under release-notes/current/<section>/<pr-number>-<slug>.md (see release-notes/current/README.md for sections and naming). N/A if this PR does not contain non-trivial changes. — added release-notes/current/bug_fixes/9807-eg-image-fallback-global-imageregistry.md.
• Generated files committed: Ran make gen-check and committed the result if API/helm charts/modules changed. — the regenerated golden output is committed.
• Scope & compatibility: The PR is reasonably scoped (no unrelated changes) and preserves backward compatibility, or any breaking change is called out above and documented in release-notes/current/breaking_changes/. — backward compatible: with global.imageRegistry unset the rendered registry is unchanged, and all 34 pre-existing golden files are byte-identical.
• Codex review: Requested a Codex review and addressed all of its comments.
• Copilot review: Requested a Copilot review and addressed all of its comments.

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	153e176
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a8c5c0a06056a0007d3b38f
😎 Deploy Preview	https://deploy-preview-9807--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[weatherhog]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 1f4500b0b7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.34%. Comparing base (4de02ef) to head (153e176).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9807   +/-   ##
=======================================
  Coverage   76.34%   76.34%           
=======================================
  Files         261      261           
  Lines       44523    44523           
=======================================
+ Hits        33989    33992    +3     
  Misses       8285     8285           
+ Partials     2249     2246    -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.