feat(skills): add native AI Gateway deployment skill

[rspurgeon]

Agents setting up native Konnect AI Gateway currently have only the general
declarative guide. Add a dedicated kongctl-ai-gateway skill that carries a
user from one OpenAI-backed local gateway to more models, caller access
controls and an auditable deployment pipeline.

The skill includes a declarative starter, a certificate/data-plane helper,
and focused references for local inference, model authorization and CI/CD.
It preserves resource identities during expansion, defers credentials, and
requires execution of the reviewed saved plan across the approval boundary.
Bundle it in kongctl install skills, update installer coverage and document
discovery. The existing general declarative skill is unchanged.

Validation

• Repository gates: modernization, formatting, build and make test-all
  (lint, installer tests, race-enabled unit tests, E2E metrics tests and
  integration tests in mock SDK mode).
• Skill frontmatter validation, ShellCheck and bundled installation checks.
• Offline native-loader and helper checks, including certificate reuse,
  external key handoff and deferred credentials.
• Separate fresh-agent authoring evaluations using gpt-5.6-sol at medium
  effort and kongctl 1.15.1: basic setup passed 10/10 authoring criteria;
  the final combined pipeline run passed 21/21. The latter was a fresh
  agent given the same starter, with no prior transcript or evaluator notes.
  Independent checks exercised all twelve caller/model cases, rejected
  broken response assertions, and tested saved-plan integrity/identity guards.

These are local authoring results from an iterative known-scenario
evaluation, not a measured success rate. The evaluation harness and original
run artifacts remain outside this repository. Live Konnect deployment,
GitHub approval settings, Docker on macOS and real inference are pending.
The generated r4 pipeline has a style-only ShellCheck finding and relies on
human rejection of superseded plans; it does not query current branch head
while waiting for approval. Keep this PR in draft through the MacBook
rehearsal for “Deterministic Platform Operations for AI Agents.”

MacBook rehearsal handoff

Use the skill content from this branch; an existing released kongctl binary
does not contain this new bundled skill yet. To prepare a separate project
without building kongctl, run from a directory where these new directory
names are available:

gh repo clone Kong/kongctl kongctl-skills -- --branch skills
mkdir -p ai-gateway-rehearsal/.agents/skills
cp -R kongctl-skills/skills/kongctl-ai-gateway \
  kongctl-skills/skills/kongctl-declarative \
  ai-gateway-rehearsal/.agents/skills/
cd ai-gateway-rehearsal
kongctl version --full

Start a fresh coding-agent conversation in ai-gateway-rehearsal. The
evaluations used kongctl 1.15.1 and gpt-5.6-sol at medium effort; record any
version/model changes. This is an authenticated live rehearsal on macOS;
the Linux bubblewrap baseline isolation does not transfer with these files.
Keep the source checkout and evaluator answers out of the agent's project.

Select the Konnect profile, organization, region/base URL, dedicated
namespace, GitHub repository and three accessible OpenAI model IDs.
Supply credentials through local or CI stores. Generate a real certificate
pair on the MacBook and preserve it between stages. Rehearse the Docker
image architecture and mounted-key access on the actual presentation machine.

Stage one prompt:

Set up a basic native Kong AI Gateway with one OpenAI model and a local
Docker data plane on this MacBook. Manage configuration declaratively with
kongctl. Prepare the project and a concrete saved plan for review, then
help me deploy it and route a request after I approve that plan.

Establish a connected data plane and a real completion through the local
proxy before continuing. Keep the same project and agent session for stage
two so its first-stage history is legitimate context.

Stage two prompt:

Expand this working setup into a GitHub Actions deployment workflow. Add
two more OpenAI models and two caller identities: one can use every model,
and one can use only the original model. Keep the same gateway and local
data plane. Make proposed changes auditable, require human approval, and
deploy the reviewed saved plan. Help me demonstrate access controls and a
repeat deployment.

Show the actual CI plan/diff, the required-reviewer pause, execution of that
same digest, all twelve access cases, and an unchanged follow-up plan.
Finish by reviewing and executing a scoped cleanup/reset. Record required
interventions and runtime issues before deciding whether the skill needs
another revision.