feat(vanity-gateway): add per-target shadow policies

[FamousDirector]

TL;DR

Add per-target vanity gateway shadow policies while retaining all existing shadow configuration fields and behavior.

Additional Details (optional for docs, build, test, refactor, ci, chore, style, and revert PRs)

• Add an additive shadows list with per-target model, percentage, sampling method, and cancellation settings.
• Normalize the five legacy top-level fields into the same runtime representation without changing their shared-policy semantics.
• Reject mixed legacy and structured forms, duplicate targets, invalid policies, unknown nested fields, self references, and cross-section references.
• Reuse one request-local bucket for targets with the same sampling method, preserving legacy correlated admission when policies match.
• Apply cancellation independently per admitted target and keep replay bodies bounded by sequential rewrite and dispatch.
• Extend the Helm schema while preserving working empty and null legacy defaults and the multipart compatibility boundary.
• Update the sample configuration and service and chart documentation.

For the Reviewer

Please focus on legacy normalization in gateway_config, per-target admission and cancellation in gateway/openai_director.go, and Helm schema parity for mixed and multipart configurations.

For QA (optional for docs, build, test, refactor, ci, chore, style, and revert PRs)

• go test -count=1 ./...
• go test -race -count=1 ./gateway ./gateway_config
• bazel test //src/invocation-plane-services/vanity-gateway/... (6 tests passed)
• helm lint deploy/helm/vanity-gateway/helm-nvcf-vanity-gateway
• Helm render checks for structured, legacy empty/null, mixed-form, and multipart configurations
• git diff --check

QA is not required beyond normal review and CI.

Issues

Closes #1243

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}