install: route kind component deploys through the overlays

[NekoPunch (orangeCatDeveloper)]

Fixes #702

Summary

--deploy-atenet and --deploy-ate-apiserver applied base manifests directly, skipping the kind overlay's OTel env patches, so components deployed through those flags silently exported telemetry to the GKE-only collector address. They now route through per-component kind overlays the way --deploy-atelet already does, with the root kind overlay composing the three so each patch exists in exactly one place. hack/verify/kind-overlays.sh (picked up by verify-all.sh) guards the routing, the render equivalence, and the per-container env values.

Test plan

• Pre/post-refactor full kind renders are byte-identical across all 57 resources.

• Six negative injections each fail the verifier (helper bypassed, container renamed, env values changed or deleted, duplicate patch re-added at root).

• Real kind cluster: --deploy-atenet lands the otel-system endpoint without manual intervention; the metrics e2e suite went from a 120s timeout to a sub-second pass.

• bash -n, hack/verify/shellcheck.sh, and hack/verify/boilerplate.sh pass.

• Tests pass

• Appropriate changes to documentation are included in the PR (none needed)

[Max Smythe (maxsmythe)]

Thanks for the fixes! Had a few comments

[Max Smythe (maxsmythe)]

I'm not sure we want to use hack/verify as a unit test for the deploy script.

Benjamin Elder (@BenTheElder) any opinions?

[Max Smythe (maxsmythe)]

This looks like it is parsing the overlays and making sure all resources of a specific kind have the expected overlays, is that correct?

I like the idea of it, but why not parse the YAML directly? Maybe include this as a standalone Python script and avoid the bash validation?

Maintaining overlays seems like a more durable validation problem.

[Max Smythe (maxsmythe)]

should render_atenet_router_manifest be made to understand the kind switch? It looks like other similar functions do:

substrate/hack/install-ate.sh

Lines 161 to 198 in 55f16fa

	render_ate_system_manifests() {
	local client_auth=""
	local router=""
	client_auth="$(ateapi_client_auth)"
	router="$(atenet_router)"
	if [[ "${router}" == "agentgateway" ]]; then
	local overlay="manifests/ate-install/agentgateway"
	if [[ "${client_auth}" == "token" ]]; then
	overlay="manifests/ate-install/agentgateway-token-client"
	fi
	if [[ "${ATE_INSTALL_KIND:-false}" == "true" ]]; then
	overlay="manifests/ate-install/kind-agentgateway"
	if [[ "${client_auth}" == "token" ]]; then
	overlay="manifests/ate-install/kind-agentgateway-token-client"
	fi
	fi
	kubectl kustomize "${overlay}" --load-restrictor LoadRestrictionsNone | run_ko resolve -f -
	return
	fi
	if [[ "${client_auth}" == "token" ]]; then
	local overlay="manifests/ate-install/token-client"
	if [[ "${ATE_INSTALL_KIND:-false}" == "true" ]]; then
	overlay="manifests/ate-install/kind-token-client"
	fi
	kubectl kustomize "${overlay}" --load-restrictor LoadRestrictionsNone | run_ko resolve -f -
	return
	fi
	if [[ "${ATE_INSTALL_KIND:-false}" == "true" ]]; then
	# Build everything resolved with Kustomize for Kind
	kubectl kustomize manifests/ate-install/kind --load-restrictor LoadRestrictionsNone | run_ko resolve -f -
	else
	# Build everything resolved with base manifests for GKE
	run_ko resolve -f manifests/ate-install
	fi
	}