Enable the programmed-set endpoint in the test environment

The endpoint that lets the parity test confirm the proxy is running exactly the
set the build intended is off by default and served only when asked for. The
base deployment reads --enable-programmed-set from the ENABLE_PROGRAMMED_SET env
var; flip it to "true" in the downstream edge overlay with a strategic-merge
patch on env so the test environment keeps that visibility while production
exposes nothing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JbCy8vy66RdNYzGSgqH6P6

Author: scotwells

config/e2e-downstream/extserver-base/kustomization.yaml

@@ -26,3 +26,7 @@ patches:
     target:
       kind: Deployment
       name: envoy-gateway-extension-server
+  - path: patches/extserver-programmed-set.yaml
+    target:
+      kind: Deployment
+      name: envoy-gateway-extension-server

config/e2e-downstream/extserver-base/patches/extserver-programmed-set.yaml

@@ -0,0 +1,17 @@
+# Turn on the read-only /debug/programmed-set endpoint so the parity test can
+# confirm the proxy is running exactly the set the build intended. The base
+# deployment reads --enable-programmed-set from this env var, defaulting off in
+# production; flip it to "true" here for the test environment. Strategic-merge
+# on env (matched by name).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: envoy-gateway-extension-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: envoy-gateway-extension-server
+          env:
+            - name: ENABLE_PROGRAMMED_SET
+              value: "true"