Feat: Add Praxis as a third supported proxy (alongside the Go proxy and Envoy proxy)

[huang195]

Summary

Add Praxis as a third proxy data-plane supported by Cortex, alongside the existing Go proxy (proxy-sidecar) and Envoy proxy (envoy-sidecar) — and wire praxis mode end-to-end so users can select it when creating an agent.

Context

Cortex (formerly AuthBridge) runs its auth/enforcement pipeline behind two proxy implementations today:

• the Go-native proxy (proxy-sidecar mode), and
• Envoy (envoy-sidecar mode, via ext_proc).

This issue adds Praxis as a third selectable proxy and exposes it through the platform so it's a first-class choice at agent-creation time.

Scope

Cortex (this repo — rossoctl/cortex)

• Integrate Praxis as a selectable proxy data-plane.
• Wire Praxis to the shared proxy shim layer (depends on the shim rearchitecture, Refactor: Separate proxy data-planes from a shared proxy shim layer #682).
• Mode/config selection between go / envoy / praxis; the mode: in YAML must match the binary/image.

Platform wiring — let users select Praxis mode when creating an agent

Operator (rossoctl/operator, formerly kagenti-operator) — sidecar injection:

• Add praxis as a selectable proxy mode on the AgentRuntime CR (alongside envoy-sidecar / proxy-sidecar).
• Inject the Praxis sidecar (image, ports, args, resources) when praxis mode is resolved; wire proxy-init if Praxis needs iptables (transparent) or HTTP_PROXY (forward).
• Map the resolved mode → the correct Cortex image + runtime config; validate the mode value; keep default behavior unchanged when unset.
• Render any Praxis-specific ConfigMaps (mirroring envoy-config for envoy-sidecar).

Platform / UI / installer (rossoctl/rossoctl, formerly kagenti):

• Surface Praxis in the agent-creation UI (proxy-mode selector).
• Plumb the UI selection through to the operator CR (AgentRuntime spec).
• Helm / install templates: render Praxis-mode assets where the other modes are rendered.
• Docs: document choosing praxis mode in the agent-creation flow.

Related

• Part of epic: Cortex Phase 1 (epic: Cortex Phase 1 rossoctl#2244)
• Depends on the proxy ↔ shim separation rearchitecture: Refactor: Separate proxy data-planes from a shared proxy shim layer #682