SecurityPolicy reports Merged: True but the merged JWT filter is not enforced

[MintBlueJelly]

Title: SecurityPolicy reports Merged: True but the merged JWT filter is not enforced

Version: Envoy Gateway v1.8.3, Gateway API v1, Envoy distroless-v1.38.3

A Gateway-level SecurityPolicy with jwt + authorization, and a route-level SecurityPolicy with
oidc and mergeType: JSONMerge targeting an HTTPRoute on that Gateway.

Status on the route-level policy reports the merge succeeded:

ancestors:
  - ancestorRef: {name: eg-external}
    conditions: [{type: Merged, status: "True"}, {type: Accepted, status: "True"}]

Expected: merged config — OIDC plus the Gateway's JWT authentication and authorization rules.

Actual: the JWT filter is absent from that route's chain. A request with no token gets a 302 to
the OIDC provider instead of 401. A request with a deliberately malformed token also gets 302,
which rules out "JWT ran and passed":

Route	Route-level policy	No token	Malformed token
app-a (control)	none	401 Jwt is missing	401 Jwt header is an invalid JSON
app-b	oidc + mergeType: JSONMerge	302 to IdP	302 to IdP

Both routes are on the same Gateway and the same Gateway-level SecurityPolicy.

mergeType: StrategicMerge behaves the same (no Merged condition is reported in that case).

Impact: the Gateway-level JWT policy is a fail-closed backstop — it is what makes a
misconfigured upstream authenticator fail safe. Merged: True with no enforcement makes that
silently untrue for any route that also wants OIDC, and nothing in the status surfaces it.

Question: is oidc + jwt on one route an unsupported combination? If so, the policy should
be rejected rather than reported as merged.