This epic is to provide a tested and documented migration path from workloads running in traditional sidecar mode to Istio's ambient mode, including both ztunnel and waypoint.

The migration should be such that the impact on the workloads is minimized - zero-downtime ideally. If an interruption is required, it should be minimized.

There may be upstream feature work that would enable this, as it has been called out as an Istio 2025 roadmap item (not sure what work was done). Perhaps the sail-operator could also assist with this.

The output of this epic would be a new documentation page with the migration procedure.