BDD suites: single and multi cluster with PKI and LLM function coverage

[along-2017]

Description

Validate the local BDD suites end to end on a laptop k3d setup, covering
both topologies and both workload concerns:

• Single cluster
• Multi cluster
• LLM function type: deploy and invoke an LLM function through the gateway
  and request router
• PKI: the managed LLM PKI issuer and the cross-plane trust chain.

Coverage splits by tunnel mode: the existing Helmfile features gain
LLM function scenarios over the insecure QUIC tunnel; PKI-secured
coverage lives in new per-topology feature files with their own
installs, so the default fixtures and the CLI features stay
unchanged. Multi-cluster LLM invocation in either mode first needs
the local topology tooling to expose the LLM request router across
clusters.

Defects found while running the suites are fixed in pull requests linked
to this issue.

Work items

• LLM function over the insecure tunnel, single cluster
• Expose the LLM request router to compute clusters in the local
  topology tooling
• LLM function over the insecure tunnel, multi cluster
• Single-cluster PKI feature: install assertions, trust
  distribution, secured LLM invoke
• Multi-cluster PKI feature: secured cross-cluster LLM invoke as
  the trust-chain proof

Resources (optional)

• tests/bdd/ for the suite layout, entry points, and cleanup modes.

---

By submitting this issue, you acknowledge that you are an assigned member of the NVCF development team and agree to follow our code of conduct and our contributing guidelines.