chore(chart): pin the egress gateway to agentgateway 2.2.2

[teemow]

Closes #109.

Problem

The chart pins the egress gateway image to agentgateway-upstream 2.2.1. That version answers an egress policy call that never reached its policy service with 403 denied when it should be 503 unavailable, so an outage looks like a policy refusal.

Change

images.agentgateway goes from 2.2.1 to the stable 2.2.2 (gsoci.azurecr.io/giantswarm/agentgateway-upstream/agentgateway:2.2.2), which carries the fix. This is a values-only change: no template, FORK.md or test edits. Because it only touches the image line in values.yaml, it does not conflict with the open #104, #106, #107 or #108. Those edit FORK.md, atenet-egress.yaml and other values keys.

Verification

• helm unittest charts/substrate: 60 of 60 pass. images_test accepts the stable tag.
• The release candidate is checked end to end in a test cluster: the agent and platform suites pass with the egress gateway on 2.2.2.

This PR was written by an agent.