atenet: route AgentGateway traffic through worker CONNECT

[EItanya]

Summary

• return separate worker CONNECT proxy and actor destination targets from the ingress extproc
• route both AgentGateway actor paths through a named mTLS worker backend using backendTunnel
• add a manual native amd64/arm64 workflow for publishing an AgentGateway image from a requested repository SHA

Testing

• go test ./cmd/atenet/internal/router/ingress
• go test ./cmd/atenet/internal/router/...
• go test ./internal/atunnel
• kubectl kustomize --load-restrictor LoadRestrictionsNone manifests/ate-install/agentgateway-router
• git diff --check

The kagent TestAgentInstanceInteraction acceptance test was not run locally because no kagent checkout or Kubernetes context is available.