Fix: tenant-root domain always overrided to example.org - #10

Following kvaps' review, move the ZK→KRaft migration logic out of the
chart templates and into a pre-upgrade Job gated by a
<release>-kafka-deployed-version ConfigMap (seaweedfs/etcd pattern).

The chart now ships pure KRaft on day one:
- Kafka CR always renders with strimzi.io/kraft=enabled and no
  spec.zookeeper block.
- All lookup-based state detection is removed from kafka.yaml,
  kafkanodepools.yaml, metrics-configmap.yaml, workloadmonitor.yaml and
  dashboard-resourcemap.yaml.
- The zookeeper: block is dropped from values.yaml, values.schema.json,
  types.go and the kafka-rd openAPISchema.

Migration of existing ZK clusters is handled by a new
templates/migration-hook.yaml that renders only when the version
ConfigMap is missing or below "1". The Job creates broker + controller
KafkaNodePools (with Helm ownership labels so the subsequent chart
apply can adopt them), annotates the Kafka CR with
strimzi.io/node-pools=enabled and strimzi.io/kraft=migration, polls
status.kafkaMetadataState until KRaftPostMigration or later, flips the
annotation to enabled and waits for KRaft.

Deviation from kvaps' proposal: separate broker+controller pools
instead of a combined pool. Strimzi 0.45 does not support migration
into a combined pool, so a homogeneous separate-pool layout works for
both fresh installs and migrations without conditional logic.

Other review fixes:
- _versions.tpl: sortAlpha on the allowed-versions error message (cozystack#10).
- e2e: rebased on main (event-driven kubectl waits), drops zookeeper
  readiness checks.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Following kvaps' review, move the ZK→KRaft migration logic out of the
chart templates and into a pre-upgrade Job gated by a
<release>-kafka-deployed-version ConfigMap (seaweedfs/etcd pattern).

The chart now ships pure KRaft on day one:
- Kafka CR always renders with strimzi.io/kraft=enabled and no
  spec.zookeeper block.
- All lookup-based state detection is removed from kafka.yaml,
  kafkanodepools.yaml, metrics-configmap.yaml, workloadmonitor.yaml and
  dashboard-resourcemap.yaml.
- The zookeeper: block is dropped from values.yaml, values.schema.json,
  types.go and the kafka-rd openAPISchema.

Migration of existing ZK clusters is handled by a new
templates/migration-hook.yaml that renders only when the version
ConfigMap is missing or below "1". The Job creates broker + controller
KafkaNodePools (with Helm ownership labels so the subsequent chart
apply can adopt them), annotates the Kafka CR with
strimzi.io/node-pools=enabled and strimzi.io/kraft=migration, polls
status.kafkaMetadataState until KRaftPostMigration or later, flips the
annotation to enabled and waits for KRaft.

Deviation from kvaps' proposal: separate broker+controller pools
instead of a combined pool. Strimzi 0.45 does not support migration
into a combined pool, so a homogeneous separate-pool layout works for
both fresh installs and migrations without conditional logic.

Other review fixes:
- _versions.tpl: sortAlpha on the allowed-versions error message (cozystack#10).
- e2e: rebased on main (event-driven kubectl waits), drops zookeeper
  readiness checks.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Signed-off-by: Matthieu <[email protected]>

A hand backport that carries more than one change names all of them in
one phrase -- "Backport of #3938 and #4280", or "Backport of #4253 to
`release-1.6`, together with #3460" for a dependency pulled along --
and the audit read only the first number after "Backport of". The rest
were linked to nothing. A labelled original in second place then read
as MISSING while its backport PR was still open, instead of pending,
and once that PR merged it counted as landed only if the branch history
happened to prove it.

Read the whole reference list the phrase carries, and the together-with
form this repository writes. A list counts in full only when it visibly
ends: at the end of the line or the sentence, or where a "to
release-X.Y" clause names the target line, with the line name a whole
word: release-1.6-fixes, release-1.6.1 and release-1.6.fixes are not
lines, so punctuation after the name ends it only when a space or the
end of the text follows. One that runs on into anything else --
"Backport of #10, #20 is not included", or "#10, #20 to follow in a
separate PR" -- may be saying something about its later items, so only
its first reference, the one the phrase names directly, is kept. The issue a backport fixes, or a CI run it cites further on in
the body, is never taken for an original.

A reference qualified with another repository is now skipped instead of
read as a local number. That also tightens the old first-number rule,
which accepted any owner/repo prefix: "Backport of other/repo#20" linked
local #20, so a merged backport of something unrelated could turn that
PR's MISSING verdict into backported. Only a bare #N or one qualified
with the repository the backport PR itself lives in, compared without
regard to case, is an original.

Over every PR on release-1.4, release-1.5 and release-1.6 this changes
the links of exactly four: #4456 and #4421 each gain #4280, #4377 gains
#4231 and #4328 gains #3460. No verdict moves today, since none of the
added originals carries a backport label.

Assisted-by: LLM
Signed-off-by: Myasnikov Daniil <[email protected]>