e2e: multi-group user scenarios + temporary e2e push trigger

Add TestGuardrailMultiGroupUser to the provider matrix file: a caller in
multiple groups gets the union of its groups' policy allowlists (two restricting
policies, one per group), and a caller in a group whose policy has no guardrail
is unrestricted even when another of its groups restricts the same provider.

Re-add the temporary agent-network-e2e push trigger to validate these over the
tunnel; remove again before merge.

.github/workflows/agent-network-e2e.yml

@@ -5,6 +5,11 @@ on:
   schedule:
     - cron: "0 3 * * *"
   workflow_dispatch:
+  # TEMPORARY: run on every push to the per-policy model-allowlist branch while
+  # it is under review. Remove this push trigger before merge.
+  push:
+    branches:
+      - agent-network-per-policy-model-allowlist
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}