Ingress only covered /console -- agent-console run got a 404 hitting /run since Kong had no route for it. Same Service, same port, just more paths on the one Ingress.
Kong route to the agent-hub Service so agent-console can attach over the existing gateway instead of kubectl port-forward.