Helm: Set compatible proxy image in `global.images.envoyProxy.image`

Description

https://github.com/envoyproxy/gateway/blob/3ab110e76778ed3f5ea9365b6f0d0753c2b2dd9c/charts/gateway-helm/values.tmpl.yaml#L28-L31

#8785 added global.images.envoyProxy.image to gateway-helm. Nice addition! The default value is "", which falls back to the DefaultEnvoyProxyImage Go constant baked into the controller binary.

The release process already pins image tags "in both the source code and the Helm chart" (RELEASING.md step 9. For example in #8902:

• DefaultEnvoyProxyImage in api/v1alpha1/shared_types.go → docker.io/envoyproxy/envoy:distroless-v1.38.0
• global.images.ratelimit.image in charts/gateway-helm/values.tmpl.yaml → docker.io/envoyproxy/ratelimit:fe26676d

but global.images.envoyProxy.image is not changed.

Why

In restricted/air-gapped environments every image must be mirrored (and often signed), and that tooling typically discovers images by scanning rendered manifests (helm template / ArgoCD). Because the Envoy proxy Deployment is created by the gateway controller at runtime, the image appears nowhere in rendered output if the Helm value is empty. In our case we have to hand-pin the proxy image and manually track the EG<->Envoy compatibility matrix on every upgrade.

With a chart default, the image appears in the rendered ConfigMap and our image tooling can it up automatically. The ratelimit image already works like this.

Proposal

Extend the release step (RELEASING.md) to also set the compatible image version in global.images.envoyProxy.image in values.tmpl.yaml.

Or; set it while packaging the chart ${GatewayImage}, sourced from the Go constant?

Let me know if you want a PR created for this!