feat(tenant): provision a self-contained ComputePlane for untrusted-code apps - #3150

The fluxcd addon pin was a holdover from the #3150-era model where app
charts rendered nested HelmReleases into the target cluster and needed an
in-cluster helm-controller. Consumers now keep their releases on the
management cluster and remote-apply via spec.kubeConfig, so the management
Flux resolves charts and applies manifests — nothing inside the ComputePlane
reconciles HelmReleases. This also decouples the module from the FluxCD
addon removal (#3379). certManager and ingressNginx stay pinned: Certificate
and Ingress objects land inside the cluster and need their controllers
there.

Assisted-By: Claude <[email protected]>
Signed-off-by: Andrei Kvapil <[email protected]>

The fluxcd addon pin was a holdover from the #3150-era model where app
charts rendered nested HelmReleases into the target cluster and needed an
in-cluster helm-controller. Consumers now keep their releases on the
management cluster and remote-apply via spec.kubeConfig, so the management
Flux resolves charts and applies manifests — nothing inside the ComputePlane
reconciles HelmReleases. This also decouples the module from the FluxCD
addon removal (#3379). certManager and ingressNginx stay pinned: Certificate
and Ingress objects land inside the cluster and need their controllers
there.

Assisted-By: Claude <[email protected]>
Signed-off-by: Andrei Kvapil <[email protected]>

The fluxcd addon pin was a holdover from the #3150-era model where app
charts rendered nested HelmReleases into the target cluster and needed an
in-cluster helm-controller. Consumers now keep their releases on the
management cluster and remote-apply via spec.kubeConfig, so the management
Flux resolves charts and applies manifests — nothing inside the ComputePlane
reconciles HelmReleases. This also decouples the module from the FluxCD
addon removal (#3379). certManager and ingressNginx stay pinned: Certificate
and Ingress objects land inside the cluster and need their controllers
there.

Assisted-By: Claude <[email protected]>
Signed-off-by: Andrei Kvapil <[email protected]>

…ted-code apps (#3280)

## What this PR does

Implements the ComputePlane per the merged design proposal
([cozystack/community
design-proposals/compute-plane](https://github.com/cozystack/community/tree/main/design-proposals/compute-plane);
supersedes the earlier #3150 which was built on the pre-revision surface
and came from a fork): a managed, isolated environment for running
code-executing (untrusted-code) catalog applications.

ComputePlane is delivered as an operator-owned **tenant module**:

- **`packages/extra/computeplane`** — the module chart. Provisions a
single-tenant, Cozystack-managed cluster by deploying the ordinary
`apps/kubernetes` chart (Kamaji control plane + KubeVirt-VM workers)
with operator-fixed values: the Cozystack-enablement addons (`fluxcd` +
pinned distribution artifact, `certManager`, `ingressNginx` with
`exposeMethod: Proxied`) are inline `spec.values`, so nothing injected
via `valuesFrom` can disable them. The tenant can set cluster *shape*
(`nodeGroups`, schema-validated) and receives no admin kubeconfig.
- **Release naming**: neither HelmRelease sets `spec.releaseName` — the
aggregated API rebuilds HelmRelease specs without that field, so both
releases derive names from their object names. The cluster HelmRelease
object is `computeplane-cluster`, and Kamaji writes the admin kubeconfig
to the derived Secret **`computeplane-cluster-admin-kubeconfig`** — the
contract future `placement: ComputePlane` routing consumes.
Tenant-visible secrets are an allowlist (`include: []` withholds
everything), so the credential is withheld by construction.
- **`packages/system/computeplane-rd`** — registers the `ComputePlane`
module-kind (`ApplicationDefinition`, `dashboard.module: true`).
- **`packages/core/platform/sources/computeplane-application.yaml`** —
self-contained package source: re-declares `apps/kubernetes` as its own
source-only component; `dependsOn` cozystack-engine
(ApplicationDefinition CRD) and kubernetes-application (registration
ordering). Ships in the `iaas` bundle (variant `kubevirt`).
- **Tenant toggle** — `computeplane: false` bool. The tenant chart fails
loudly when the module is toggled on without the iaas package. Note:
automatic `placement: ComputePlane` routing is a deferred follow-up and
is not part of this PR; until it lands, external catalogs target the
cluster via its kubeconfig Secret.
- **`apps/kubernetes` fix** — the Proxied ingress `Service` renders only
when the ingress-nginx addon is enabled **and** the tenant has etcd
(mirroring the addon HelmRelease gates), independent of the `hosts`
list.

Follow-ups tracked separately: `placement` routing in cozystack-api,
scoped per-service egress, visibility/mutation access control, e2e
(#3369), release-name guards for the remaining extra charts (#3371).

Tests: helm-unittest suites pin the module contract (object names, no
explicit releaseName, tamper-proof inline addons, nodeGroups validation
+ ingress-role guard, unlisted-field pass-through), the tenant toggle,
the package-source/bundle wiring, and the ingress Service gates.

### Screenshots

Not a UI change.

### Release note

```release-note
feat(computeplane): ComputePlane tenant module — a single-tenant, Cozystack-managed cluster for untrusted-code applications, delivered as an operator-owned extra module wrapping the kubernetes app. Enable with `computeplane: true` on the Tenant; the tenant receives no admin kubeconfig for it, and the cluster's admin kubeconfig Secret is `computeplane-cluster-admin-kubeconfig`. Catalog routing (`placement: ComputePlane`) ships separately.
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a new **ComputePlane** tenant option (`computeplane`, default
off) to provision an isolated single-tenant environment for
untrusted-code applications, including cluster creation and configurable
**node groups**.
* **Bug Fixes**
* Refined ingress-nginx proxied rendering rules to avoid emitting
incomplete resources: Ingress/Services are now gated on addon enablement
(and etcd-backed tenancy), with correct behavior when hosts aren’t
provided.
* **Documentation / Tests**
* Updated tenant and ComputePlane documentation; added/extended
rendering tests for the new ComputePlane module and ingress-nginx gating
(including release-name and etcd-less cases).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->