tare manage gateway install

Install the management plane's ingress: a k8s Gateway plus HTTPRoutes
fronting the management-plane services.

Provider selection via --type, mirroring the data plane's 'tare gateway install'.

GCP (--type gcp, default):
  Renders the gcp-gateway-manage-helm chart — a GKE Gateway (gatewayClassName
  gke-l7-global-external-managed) and HTTPRoutes for the management-plane
  services into tars-gateway-{customer}, routing to the Services in
  tars-system-{customer}. The TLS certificate map (computed
  {customer}[-{environment}]-tetrate-ai) and any --static-ip-name are
  prerequisites created out-of-band via Certificate Manager and a reserved
  global address. The chart is not embedded in tare — pass --chart-version or
  --chart-path. Run 'tare manage install' first so the target Services exist.

Azure (--type azure) / AWS (--type aws):
  Not yet implemented for the management plane — only the GCP Gateway chart
  exists today. The data plane already covers these
  ('tare serve gateway install --type azure|aws'); the management-plane
  equivalents (AGIC Ingress / NLB fronting the management-plane services) are
  planned to slot in here.

Examples:
  # Preview the rendered Gateway chart values (GCP)
  tare manage gateway install --customer acme --chart-version v0.1.0 --print-helm-values

  # Install into tars-gateway-acme with a reserved static IP
  tare manage gateway install --customer acme \
    --static-ip-name acme-mp-ip --chart-version v0.1.0

Usage:
  tare manage gateway install [flags]

Flags:
      --chart-no-cache           Bypass the ~/.tare/charts cache when fetching --chart-version.
      --chart-path string        Local path or oci:// reference to the gcp-gateway-manage-helm chart. Overrides --chart-version.
      --chart-registry string    OCI registry for --chart-version (default: registry.tetrate.ai).
      --chart-version string     gcp-gateway-manage-helm chart version to fetch from --chart-registry. Required unless --chart-path is a local path.
      --customer string          Organization (customer) identifier (drives namespaces, domain, and cert map). Required.
      --environment string       Deployment environment (empty = production); selects the domain + cert-map suffix.
      --namespace string         Helm release namespace (default: tars-release-{customer}).
      --no-wait                  Return after Helm finishes; do not wait (overrides --wait).
      --print-helm-values        Print the generated values and exit without touching the cluster.
      --release-name string      Helm release name (default: tars-{customer}-gateway).
      --security-policy string   Cloud Armor WAF policy name to attach to the backend policies.
      --static-ip-name string    Reserved global static IP name to bind the Gateway to (networking.gke.io/static-ip-name).
      --timeout string           Timeout for --wait. (default "10m")
      --type string              Gateway provider type: gcp (azure/aws planned, mirroring 'tare serve gateway install'). (default "gcp")
      --values string            Extra Helm values file merged after the generated values (-f); use for hostname overrides / an internal Gateway.
      --wait                     Wait for the release to become ready (helm --wait; default true; use --no-wait to disable). (default true)

Global Flags:
  -q, --quiet     Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose   Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr