fix: give WAF gateway Programmed assert room for cold image pull

With the datum-downstream-gateway namespace now labelled, the downstream
Envoy Gateway accepts the GatewayClass and programs waf-gw. CI evidence
shows Envoy Gateway flushes the Programmed=True status at ~30s, missing
chainsaw's 30s assert default by milliseconds: the merged Envoy fleet must
first pull the contrib Envoy image and the Coraza WAF init image cold on
the kind node, and Envoy Gateway only reports Programmed once those
endpoints exist.

Raise the Programmed assert timeout to 3m so the first-pull window does not
flake the test, matching the longer timeouts the gateway-invalid-certificate
suite already uses for the same data plane.

Author: ecv

test/e2e/trafficprotectionpolicy-enforce/chainsaw-test.yaml

@@ -123,6 +123,11 @@ spec:
                   - type: OWASPCoreRuleSet
                     owaspCoreRuleSet: {}
         - assert:
+            # The downstream Envoy fleet pulls the contrib Envoy and Coraza WAF
+            # init images cold on the kind node before its endpoints exist, and
+            # Envoy Gateway only writes Programmed once they do. That first-pull
+            # window overruns chainsaw's 30s assert default, so allow more time.
+            timeout: 3m
             resource:
               apiVersion: gateway.networking.k8s.io/v1
               kind: Gateway