test(e2e): expand event gateway external sync child coverage

[rspurgeon]

The event-gateway external-sync scenario did not cover schema registries,
static keys, or TLS trust bundles under an API-created gateway.

Add three overlays and seven steps that verify CREATE plans and applied counts,
resource names/descriptions and type-specific fields, idempotency for all three
resources, and preservation when the child collections are omitted. Existing
scenario steps remain unchanged.

Closes #2181.

Validation:

• CGO_ENABLED=0 go fix ./..., make format, and make build passed.
• make lint passed with zero issues.
• MISE_SHELLCHECK_VERSION=0.11.0 make -o lint test-all passed: installer,
  race-enabled unit and integration tests, and 96 E2E tooling tests.
• Full external-sync scenario passed against Konnect, including vault-reference
  assertions in the CREATE plan and get output after creation and omission.
  Command: make test-e2e-scenarios SCENARIO=event-gateway/external-sync.
  Artifacts: .e2e-artifacts/gh-2181-review/20260916-085747.
• Changed YAML parses successfully; yamllint reports only the existing convention
  of omitting document-start markers.
• Repository-wide pre-commit could not pass because of baseline formatting and
  local hook issues (missing PyYAML and sandbox restrictions). Unrelated hook
  edits were discarded.

[kong-api-ops]

✅ KSAI Review: Finished

1. 03:57 UTC Tracing configuration merging and trust bundle handling logic

---

Run report (federated) · 1 paid run · $0.0658 total

#	Engine	Result	Model	Turns	Cost
1	opencode	success	zai-org/GLM-5.3-Flash/high	33	$0.0657

Reviewing cost $0.0657; deciding how to run it cost $0.0001

[kong-api-ops]

Check	Result
Scope	E2E scenario YAML: three new external-sync overlays (schema registry, static key, TLS trust bundle) and steps 020-026 in external-sync/scenario.yaml
Mandate	default-code-reviewer
Findings	1 Low
Findings audit	Completed (kreview:findings-auditor; 1 kept, 0 dropped)

The diff is test-only and mirrors established patterns in steps 006-019 and sibling scenarios. Fixtures (vault env PATH reference, static key value, TLS certificate) match existing repo fixtures. Step 026's omission assertions match base testdata behavior. No additional concerns found in the secrets, security and leak pass.