Attach orders routes without broadening namespace or request access

Repair gateway.yaml using Gateway, HTTPRoute and ReferenceGrant v1 objects from the supplied v1.6.2 Standard bundle. Preserve net/edge, class supplied-http, HTTP listeners web:8080/api.example.test and admin:8081/admin.example.test. The observed class is available and supports Extended method matching and optional parent-port selection. Own one or more shop HTTPRoutes; attach them only to web. web must permit HTTPRoutes from shop only; admin remains same-namespace net only. Namespace labels include kubernetes.io/metadata.name=name; shop/archive have owner=commerce and net/backend owner=platform. Selectors must stay scoped even for another namespace with otherwise matching labels. Use Service backend/orders port 8080, response orders-current. backend also holds admin:9000/private-admin and old-orders:8080/orders-obsolete. A backend port is a Service port. Place the needed ReferenceGrant in backend, allowing only gateway.networking.k8s.io HTTPRoutes from shop to the core Service named orders. Other source kinds/namespaces, target objects and unnamed all-Service grants violate the boundary. Required requests to web/api.example.test carry x-tenant:shop: GET /orders, /orders/42 and /orders/42/lines; HEAD /orders and /orders/42. Every positive-weight outcome must deliver orders-current from the required Service/port. Do not forward POST /orders, GET /orders-debug, GET /admin, GET /orders with missing or x-tenant:platform, GET /orders on evil.example.test, or GET /orders through admin:8081/admin.example.test. PathPrefix matches path elements; method/header/path combine by AND and matches by OR. Run tests, inspect attachment/reference/request witnesses and repair saved mistakes without Reset.