fix(k8s): ingress render with both custom domains and additional ports

[fedemaleh]

What

Scopes that have both a custom domain and additional ports failed on every deployment, at the step that builds the ingress manifest (Failed to build ingress template). Both initial-ingress and blue-green-ingress were affected. This fixes them.

Why we want it

Any scope in that shape is undeployable — not degraded, blocked, with no workaround other than removing the custom domain or the extra ports. Both features work fine on their own, so it only bites the combination.

Criterion behind the fix

Inside range .scope.capabilities.additional_ports, a nested range over the scope's domains rebinds the dot, so .port / .type silently pointed at a domain object instead of the port. The fix captures them into $port / $port_type before entering the nested loop.

Two things I deliberately did not do:

• Did not just fix .port. The .type read next to it returned the domain's type, which is not an error — it quietly emitted grpc, so HTTP additional ports would have pointed at a Service that does not exist, with nothing in the logs. Both fields had to be captured.
• Did not switch the rest of the loop body to $port/$port_type. Bare .port is correct everywhere the dot has not been rebound, and that is the convention these templates already follow; changing it would have churned ~30 correct lines.

Testing

k8s/deployment/tests/ingress_domains_additional_ports.bats — renders both templates with two custom domains and two additional ports (one HTTP, one GRPC). Verified failing before the fix, passing after.

Not in this PR

Two pre-existing bugs found while reviewing, each worth its own change: in blue-green-ingress.yaml.tpl the k8s_modifiers annotations block sits inside the HTTP/GRPC branch, so HTTP additional ports drop operator annotations; and host: values are emitted as unquoted YAML scalars.