fix(gateway-interceptors): configure connect timeout and HTTP/2 keepalive on interceptor gRPC channel

[letv1nnn]

Summary

The interceptor gRPC channel was dialed bare — Endpoint::from_shared(...).connect() with no connect timeout and no HTTP/2 keepalive. These channels are long-lived: ExecutionPlan::load dials once at startup and the resulting Channel is cloned into every BindingPlan and GatewayInterceptorProfileSource for the process lifetime. With no keepalive, an idle-reaping hop, load-balancer timeout, interceptor redeploy, or GOAWAY silently invalidated the connection, and the failure only surfaced on the next interceptor evaluation. With no connect timeout, an unreachable interceptor host could hang on the OS default TCP connect timeout.

This applies the repo-standard channel tuning (matching openshell-core and openshell-sdk) to both the TCP and unix-socket interceptor channels, so idle connections survive intermediary idle timeouts, dead peers are detected proactively, and dials are bounded.

Related Issue

Closes #2612.

Changes

• Add tune_endpoint helper in crates/openshell-gateway-interceptors/src/plan.rs applying connect_timeout(10s),
  http2_keep_alive_interval(10s), keep_alive_while_idle(true), keep_alive_timeout(10s), and
  http2_adaptive_window(true).
• Route connect_endpoint (TCP) and connect_unix_endpoint (unix socket) through tune_endpoint instead of dialing a bare endpoint.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[pimlock]

/ok to test 81b2589