ycb_cilium_ce9b780acbab1

what a new run launched now would send

Cilium’s Gateway API → CEC translator already splits Envoy Listeners by port for multi-port HTTPS. TLS passthrough does not: when a Gateway has multiple TLS passthrough listeners on different ports that share the same hostname/SNI, their filter chains still land on a shared Listener and collide, so each port cannot reach its own backend.

Fix translation so that when there is more than one distinct TLS passthrough port, each of those ports gets its own Envoy Listener with filter chains scoped only to that port’s routes, and ServiceListener entries bind each port to the matching listener—consistent with multi-port HTTPS. Keep single-port TLS passthrough working; when HTTPS and multi-port TLS passthrough are combined (including catch-all HTTPS), do not put those TLS passthrough ports on the shared/base listener or into the plaintext HTTP port list. Add coverage for a multi-port same-hostname TLS passthrough Gateway and for catch-all HTTPS alongside multi-port TLS passthrough.

Work only inside this repository checkout. Make the code change the task
describes, keeping the diff focused — no drive-by refactors.

When you are done, leave your changes committed or in the working tree;
they are collected automatically.

Stay on this snapshot checkout (`task/ycb_cilium_ce9b780acbab1`). Never checkout, pull, or rebase onto `main`. That branch is a README-only orphan.
Stay on this HEAD. Do not fetch another default branch. Push only on the Cursor-created `crazy-cursor/…` side branch from this HEAD.

Some past runs of this task were launched with a different prompt (the prompt template changed since, or those runs predate this benchmark's stored prompt). Each run persists the exact prompt it sent at launch — that per-launch record is the audit trail; this page shows only the current one.