fix: produce valid listener names for wildcard and unusual DNS names

A DNS name like *.home.hrajfrisbee.cz put "*" into the listener name; the
API server rejected the patch, which blocked every certificate on that
Gateway.

- lowercase the DNS part, spell "*" as "wildcard", map other characters
  outside [a-z0-9] to "-"
- names over 253 chars are cut and get a hash suffix instead of a blind cut
- names that were valid before are unchanged

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans-executions/2026-10-08-2046-listener-name-sanitize.md

@@ -3,7 +3,32 @@
 Plan: `docs/plans/2026-10-08-2046-listener-name-sanitize.md`
 
 - [x] Step 0 — Save and commit the plan
-- [ ] Step 1 — Regression tests first
-- [ ] Step 2 — Fix
-- [ ] Step 3 — Docs
+- [x] Step 1 — Regression tests first
+- [x] Step 2 — Fix
+- [x] Step 3 — Docs
 - [ ] Step 4 — Ship
+
+## Steps 1–3 — Tests, fix, docs
+
+Tests were written first and failed on the old code (wildcard, uppercase, `_`,
+trailing dot, long names), then passed after the change to `listenerNameFor`.
+
+```
+$ go test -race -run 'TestListenerNameFor|TestBuildListeners' -v ./internal/gateway/
+--- PASS: TestListenerNameFor_validSectionName/wildcard_label_is_spelled_out
+--- PASS: TestListenerNameFor_longNames
+--- PASS: TestBuildListenersFromCertificates_wildcard
+$ make check
+ok  .../internal/gateway  coverage: 98.6% of statements
+```
+
+Deviations from the plan:
+
+- A trailing `-` or `.` is trimmed from the whole name, not only from the DNS part,
+  so a DNS name that sanitizes to nothing cannot leave the name ending in `-`.
+- One extra case: a trailing dot (`app.example.com.`) is dropped.
+- Steps 1–3 are one commit, since the tests do not pass without the fix.
+
+Worth noting: names that were valid before are unchanged, so existing listeners are
+not renamed. Not verified against a cluster; the production case is covered by the
+test using the exact cert and DNS name from the error log.