test(bdd): cover secure multi-cluster Pylon registration

[sbaum1994]

Why

Issue #1292 identified secure Pylon registration gaps that escaped the existing local multi-cluster BDD. The current suite proves that an LLM invocation succeeds, but it does not directly prove that the registration endpoint uses TLS, rejects plaintext, advertises secure concrete router endpoints, or establishes every expected registration stream and reverse tunnel.

Scope

Add tests/bdd/features/multi-cluster-helmfile-llm-registration-tls.feature as an outside-in local k3d test of secure Pylon registration across a split control-plane and compute-plane topology.

Acceptance criteria

• The feature configures an explicit HTTPS LLM registration endpoint.
• The public registration listener presents a trusted certificate for the configured hostname and negotiates HTTP/2.
• A plaintext gRPC client cannot use the TLS listener.
• WatchStargates advertises concrete router identities with explicit HTTPS Pylon dial addresses.
• A deployed LLM worker reports connected registration streams and reverse tunnels for all advertised routers.
• An authenticated LLM invocation succeeds through the registered secure path.
• The feature has a live Godog entry point and a non-live wiring test.
• The feature is run destructively on local k3d against the relevant fix Pull Request SHAs.

Parent

Relates to #1292