Cross-namespace gRPC interception via cross-kind rule precedence

Cross-namespace route isolation failure in AWS Load Balancer Controller 3.4.1 allows remote authenticated users to intercept gRPC traffic. The listener-rule sorter orders HTTPRoute-derived rules ahead of GRPCRoute-derived rules by kind instead of comparing specificity, so a catch-all HTTPRoute outranks a targeted gRPC route. Exploitation requires permission to create or update HTTPRoute objects and a shared Gateway listener that admits both namespaces, and it enables interception, spoofing, or denial of the victim namespace's gRPC traffic.