fix(push): label plaintext push gateway service as HTTP (#7717)

The gateway serves plaintext HTTP on its public container port, but the
chart currently advertises that Service port as `https`. Label it `http`
so protocol-aware proxies discover the application's actual protocol.
Numeric port 8080, target port `public`, and the application version
remain unchanged. Consumers that refer to the old Service port name must
update that reference.

Prepare chart version 0.3.1, which is absent from the current release
tags and OCI registry. This ordinary fix branch does not trigger the
chart release lane. Publishing and downstream dependency updates remain
separate steps.

This corrects protocol metadata; it is not evidence of a TLS-origination
failure. Istio controls upstream TLS through DestinationRules and
auto-mTLS independently of this port label.

Validation: added rendered-Service and container-port assertions across
default, production, and Gateway API fixtures. The assertion fails with
the old label and passes with the fix. The full chart render/lint suite
and release-contract checks pass. Repository-wide `just ci` is still
running locally.

---------

Signed-off-by: Tom Brow <tomb@block.xyz>

deploy/charts/buzz-push-gateway/templates/service.yaml

@@ -6,4 +6,4 @@ metadata:
 spec:
   selector: {{- include "push.runtimeLabels" . | nindent 4 }}
   ports:
-    - { name: https, port: {{ .Values.service.port }}, targetPort: public }
+    - { name: http, port: {{ .Values.service.port }}, targetPort: public }

deploy/charts/buzz-push-gateway/tests/render.sh

@@ -34,6 +34,18 @@ def assert!(condition, detail = "assertion failed")
   raise detail unless condition
 end
 
+# The application serves plaintext HTTP behind ingress TLS termination. Check
+# every ingress mode so service discovery never advertises application TLS.
+ARGV.each do |path|
+  resources = YAML.load_stream(File.read(path)).compact
+  service = resources.find { |x| x["kind"] == "Service" }
+  ports = service.dig("spec", "ports")
+  assert!(ports == [{ "name" => "http", "port" => 8080, "targetPort" => "public" }], ports.inspect)
+  deployment = resources.find { |x| x["kind"] == "Deployment" }
+  container_ports = deployment.dig("spec", "template", "spec", "containers", 0, "ports")
+  assert!(container_ports.any? { |port| port["name"] == "public" && port["containerPort"] == 8080 })
+end
+
 xs = YAML.load_stream(File.read(ARGV[0])).compact
 svc = xs.find { |x| x["kind"] == "Service" }
 assert!(svc.dig("spec", "ports").map { |port| port["targetPort"] } == ["public"])