TLS 1.2+ enforced via GKE Org Policy (Gateway API)