Brings 9-11-stable CI to master's final k3d state, consolidating the
five master MRs (!4967, !4984, !4982, !4983, !4985) into one change:

- Add the k3d per-job scripts (k3d.sh, k3d_deploy.sh), the
  k3d-templates + k3d-version-pipeline[-arm64] child pipelines, and the
  k3d.gatewayapi/k3d.ingress CI values.
- Wire the parallel:matrix bridge jobs (k3d v1.33/v1.34/v1.35 with v1.35
  primary, k3d_arm64, manual k3d_nginx) into .gitlab-ci.yml and drop the
  vcluster/EKS trigger jobs, scripts, and environment configs; keep a
  single GKE nightly (gke.135.amd64 -> gke.amd64).
- autodevops.sh: add the is_k3d_deployment networking branch in deploy(),
  the set_context k3d guard, and create_admin_pat() (used by k3d_deploy);
  helpers.sh: add is_k3d_deployment().

CI-only — no chart/product code changes:

The 18.11 chart already renders a gateway-wide ClientTrafficPolicy from
gatewayApiResources.envoy.clientTrafficPolicySpec, which keeps %2F in URL
paths unchanged (escapedSlashesAction: KeepUnchanged). In k3d's HTTP-only
mode this gateway-wide CTP is sufficient and there is no section-scoped
CTP to cause the port-80 overlap that motivated master's webservice CTP
fix (!4984). Verified by `helm template`: the full Envoy Gateway stack
plus exactly one gateway-wide CTP renders with no errors. The master
2-file webservice CTP fix is therefore NOT backported here.

Because the 18.11 chart defaults global.gatewayApi.enabled/installEnvoy
to false (master defaults them true), k3d.gatewayapi.values.yaml sets
them explicitly — a CI-values-only adaptation, not a chart change.

The k3s version matrix matches master (v1.33/v1.34/v1.35).

Related: #6421

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci(k3d): backport per-job k3d review/QA pipeline to 9-11-stable

See merge request !5102



Merged-by: Clemens Beck <cbeck@gitlab.com>
Approved-by: Clemens Beck <cbeck@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: João Cunha <j.a.cunha@gmail.com>

Backport of the master fix. The k3d / k3d_arm64 jobs extend
.trigger_review_job, which re-includes .gitlab-ci.yml in a child pipeline and
forwards PIPELINE_TYPE. Their STABLE_BRANCH_PIPELINE rule lacked the
`$CI_PIPELINE_SOURCE != "parent_pipeline"` guard, so on 9-11-stable the child
pipeline re-matched the rule and re-triggered the whole k3d matrix, recursing
into grandchild pipelines on every push.

Add the parent_pipeline guard to the STABLE_BRANCH_PIPELINE rule on both jobs.

Related to #6421

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci(k3d): guard k3d trigger jobs against recursion on stable branches

See merge request !5113



Merged-by: Jason Plum <jplum@gitlab.com>
Approved-by: Jason Plum <jplum@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: João Cunha <j.a.cunha@gmail.com>

[ci skip]

[ci skip]