Backport 58b647b from #3260.

What does this PR do?

Enforces the GCR registry constraint on the final DatadogAgentInternal produced after a DatadogAgentProfile merge when GKE Autopilot is enabled.

It also adds unit coverage for profiles that configure either registry.datadoghq.com or the Datadog public ECR registry.

Motivation

GKE Autopilot registry coercion previously ran only on the base DatadogAgent copy. Profile reconciliation happens later and can replace spec.global.registry, producing an Autopilot-annotated DatadogAgentInternal with images that are rejected by the GKE workload allowlist.

Applying the constraint to the final merged object ensures every Autopilot profile uses an allowed GCR registry and that the generation hash reflects the corrected spec.

Additional Notes

This addresses the profile merge edge case identified in the review of #3254.

Minimum Agent Versions

No minimum Agent or Cluster Agent version is required.

• Agent: N/A
• Cluster Agent: N/A

Describe your test plan

Unit tests + on a kind/local cluster with 2 nodes+:

• Deploy operator with profiles enabled
• Apply a DatadogAgent manifest with registry set to registry.datadoghq.com and with the Autopilot annotation experimental.agent.datadoghq.com/autopilot: "true"
  • Note you will get error logs in the operator about not being able to apply the allowlistsynchronizer (CRD from GKE) that can be ignored
• Apply a valid profile so you have 2 DDAIs (default + profile one)
• Ensure each DDAI has gcr.io/datadoghq registry instead

╭─ ~/tmp/profiles                                                                                                                         󱃾 kind-local-k8s/system 13:50:27
╰─❯ k get dd datadog-agent -oyaml | yq .spec.global.registry
registry.datadoghq.com
╭─ ~/tmp/profiles                                                                                                                         󱃾 kind-local-k8s/system 13:52:39
╰─❯ k get ddai datadog-agent -oyaml | yq .spec.global.registry
gcr.io/datadoghq
╭─ ~/tmp/profiles                                                                                                                         󱃾 kind-local-k8s/system 13:52:47
╰─❯ k get ddai foo -oyaml | yq .spec.global.registry
gcr.io/datadoghq

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)