Track version pins in the prod-fidelity e2e env (why + unpin criteria)

[ecv]

Introduced while standing up CI on the prod-fidelity env (#276, part of #275/#247). Some versions are pinned as compat workarounds (should be removed once upstream catches up), others are deliberate prod-fidelity pins (remove only when prod moves). Tracking both so no pin lingers unexamined.

Workaround pins (remove when the cause is gone)

Pin	Where	Why pinned	Remove when
helm v3.12.3	.github/workflows/test-e2e.yml (setup-helm)	kustomize v5.5.0 probes helm with helm version -c; the -c shorthand was removed in helm 3.13, so the latest helm breaks every kustomize build --enable-helm in test-infra:up.	kustomize is bumped to a release that no longer issues the -c probe (or otherwise works with helm ≥3.13). Then drop the version: and take latest helm.
kustomize v5.5.0	Makefile KUSTOMIZE_VERSION	Pre-existing; it is the root cause of the helm pin above.	Bump to a release that fixes the helm probe; re-run task validate-kustomizations + the e2e env. Unblocks removing the helm pin.
kind v0.32.0	Makefile KIND_VERSION (bumped from v0.27.0)	Taskfile.test-infra.yml hardcodes bin/kind-v0.32.0 (to ship the prod node image); the Makefile pin was bumped so make kind produces that exact binary. The hardcoded path and the Makefile var can silently drift.	Make the Taskfile reference the Makefile's KIND var instead of a hardcoded bin/kind-v0.32.0 path, so a single pin governs both. Then this bump is just the normal kind pin.

Deliberate prod-fidelity pins (remove only on prod upgrade)

Pin	Where	Why	Remove when
Envoy Gateway v1.7.4 + SDK v1.8.1	Taskfile.test-infra.yml, config/tools/envoy-gateway-downstream	EG 1.8 does not program merged gateways served through the extension manager (waf-gw stays with empty status); 1.7.4 matches production.	Production moves off EG 1.7.4.
kindest/node v1.35.5	Taskfile.test-infra.yml	Exact production edge node image.	Production Kubernetes upgrade.
coraza-waf v1.3.0-multiarch.1	Taskfile.test-infra.yml	Production WAF filter, multi-arch so it also loads on arm64 dev hosts.	Production WAF image changes.

Related

• test(infra): prod-fidelity edge test env + e2e suite #276 — CI on the prod-fidelity env (introduces the workaround pins)
• Lift the e2e suite onto the prod-fidelity two-cluster env (#226) #275 — lift the e2e suite onto the env
• Catch silent edge misconfiguration before it reaches customers #247 — the arc