Add TestGuardrailMultiGroupUser to the provider matrix file: a caller in
multiple groups gets the union of its groups' policy allowlists (two restricting
policies, one per group), and a caller in a group whose policy has no guardrail
is unrestricted even when another of its groups restricts the same provider.
Re-add the temporary agent-network-e2e push trigger to validate these over the
tunnel; remove again before merge.