test(e2e): retry forward proxy stale policy flake

[drew]

Summary

Retry expected-allowed forward-proxy e2e requests across the startup policy symlink-resolution reload. This addresses the main-branch Release Dev flake where an in-flight forward request can see a stale policy generation and transiently return 403.

Related Issue

Refs #1810

Changes

• Added a bounded retry helper for expected-allowed GraphQL forward-proxy requests.
• Added a bounded retry around the expected-allowed REST L7 forward-proxy request.
• Left denied-request assertions unchanged so permanent L7 policy regressions still fail.

Testing

• mise run pre-commit passes
• E2E tests added/updated
• rustfmt --edition 2024 --check e2e/rust/tests/forward_proxy_graphql_l7.rs e2e/rust/tests/forward_proxy_l7_bypass.rs
• cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-docker --test forward_proxy_l7_bypass --no-run
• cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-docker --test forward_proxy_graphql_l7 --no-run
• git diff --check -- e2e/rust/tests/forward_proxy_graphql_l7.rs e2e/rust/tests/forward_proxy_l7_bypass.rs

mise run pre-commit was attempted locally but did not complete in this temporary worktree. It failed python:proto while the newly-created venv was missing grpc_tools; the Rust lint phase also hit local toolchain/dependency failures (z3.h missing for z3-sys, plus an aws-lc-sys GCC/macOS SDK compile error). The focused e2e targets compile.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

Label test:e2e applied for d7f0783. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.