Rename --cordon-control-plane to --cordon-system-infra-components and its node pool label to ate-system-infra - #3210

--cordon-control-plane also pins atenet-router and atenet-egress, which are data plane components, so the name is confusing.

Renamed:

The postgres pool label ate.dev/workloadType=ate-postgres is unchanged.

The missing postgres pool error linked to docs/upgrade.md#cordoned-control-plane-postgres-pool, which doesn't exist. It now links to the System Infra Isolation section in docs/architecture.md.

AI use: I used Claude Code to make the rename and update the docs and comments, and I reviewed the diff.

Breaking change

Installs that don't use --cordon-control-plane need no action.

Installs that do:

1. Replace the old flag, env var or config file key with the new one in your scripts and config. The old flag and config key fail with an error. The old env var is ignored silently, and the install would stop cordoning.

2. Relabel and retaint the shared pool from ate-control-plane to ate-system-infra. Running pods keep running, because node selectors and NoSchedule taints only apply at scheduling. On GKE:

   gcloud container node-pools update <shared pool> --cluster $CLUSTER --location $LOCATION \
     --node-labels ate.dev/workloadType=ate-system-infra
   gcloud container node-pools update <shared pool> --cluster $CLUSTER --location $LOCATION \
     --node-taints ate.dev/workloadType=ate-system-infra:NoSchedule

   Both flags replace the pool's whole set of labels or taints, so include any others the pool carries. gcloud asks for confirmation. Add --quiet to skip it. GKE updates the existing nodes in place.

   On other providers, update the pool's node template the same way. For nodes labeled by hand, overwrite the label and taint in place:

   kubectl label node <node> ate.dev/workloadType=ate-system-infra --overwrite
   kubectl taint node <node> ate.dev/workloadType=ate-system-infra:NoSchedule --overwrite

   Don't remove the old taint before adding the new one. While the node has no taint, DaemonSets such as atelet schedule pods onto it.

3. Redeploy with ate-setup deploy ate-system --cordon-system-infra-components. The new pods schedule onto the relabeled pool.

Do steps 2 and 3 close together. A system infra pod rescheduled between them stays Pending until step 3.

• Tests pass
• Docs updated