test(bdd): cover secure multi-region Pylon registration

[sbaum1994]

Why

Issue #1292 identified multi-region discovery and Pylon registration behavior that was not covered outside-in. Existing unit and integration coverage does not prove that a deployed Pylon follows secure remote watch endpoints, registers only with concrete router identities, survives router workload identity changes, and keeps routing traffic after convergence.

Scope

Add tests/bdd/features/multi-cluster-helmfile-llm-registration-multiregion.feature as an outside-in local k3d test of secure multi-region Pylon discovery and registration.

Acceptance criteria

• Region A advertises an explicit secure Region B WatchStargates endpoint.
• A Pylon starting from Region A discovers concrete routers in both regions.
• Advertised registration identities work for Deployment and StatefulSet-backed routers and never use dashed pod-IP hostnames.
• Pylon converges to the expected registration streams across both regions.
• An authenticated LLM invocation succeeds after cross-region registration converges.
• The feature has a live Godog entry point and a non-live wiring test.
• The feature is run destructively on local k3d against the relevant fix Pull Request SHAs.

Parent

Relates to #1292