chore(maintenance): refresh and automate alpine/k8s hook image pins #2565

Context

PR #2508 added a sixth in-tree alpine/k8s hook-image pin and matched the existing tree-wide convention (1.33.4) for consistency rather than picking a fresher tag. Reviewer flagged the convention itself as stale: 1.33 reaches EOL on 2026-06-28, and the in-tree pin (1.33.4, last_updated 2025-08-17) skipped seven subsequent 1.33.x patch releases without anyone noticing.

This issue tracks two follow-up tasks: (a) refresh the pins to a current minor, and (b) put a maintenance mechanism in place so the next bump doesn't depend on a code reviewer happening to look up EOL dates.

Current state — 6 pin sites, all on alpine/k8s:1.33.4

(Out of scope: packages/system/seaweedfs/charts/seaweedfs/values.yaml:365 is a vendored upstream chart and ships 1.28.4 — not ours to bump.)

Upstream availability (per Docker Hub, as of 2026-05-04)

Proposal

A. Refresh pins to a current minor

Pick one minor and bump all 6 sites in lockstep so cluster-wide kubectl behavior remains uniform:

• Conservative: 1.33.11 — same minor as today, supported until 2026-06-28. Buys ~2 months before the next forced bump.
• Recommended: 1.34.7 — current minor, supported until 2026-10-27. Aligns with what most users' apiservers run today and stays inside the kubectl ±1-minor support skew on 1.33/1.34/1.35 apiservers.
• Aggressive: 1.35.4 — newest. Tracks upstream most closely but largest skew gap with users still on 1.33.

Pin format should match the existing convention (docker.io/alpine/k8s:<tag>). Whether to add SHA256 digest pinning to all 6 sites is a separate decision; today only cozy-system-labels.yaml pins by digest.

B. Maintenance policy / automation

Pick one of:

1. Renovate — add .github/renovate.json with a rule that groups all alpine/k8s pins into a single PR, ignores 1.32 and earlier, and prefers the latest patch of the highest non-EOL minor that is ≤ the current Kubernetes minor on the platform's supported clusters. Cadence: weekly.
2. Dependabot — coarser; bumps each pin in its own PR, can't group across files, no minor/EOL awareness. Mostly useful as a stopgap if Renovate isn't wanted.
3. Manual cadence + ownership — assign an owner, agree a quarterly review against endoflife.date/kubernetes, commit to bumping before the current pinned minor reaches EOL minus 30 days. Cheaper to set up, easier to forget.

Renovate is the right answer if we're willing to add one config file; otherwise option 3 keeps things explicit.

Acceptance criteria

• All 6 listed pin sites updated to the chosen tag in a single PR.
• CI green on the bump PR (e2e install, all hook-driven paths exercised).
• One of: .github/renovate.json rule landed, OR a MAINTENANCE.md (or equivalent) entry naming the owner and review cadence for alpine/k8s pins.
• Optional: standardize on either fully-pinned-by-digest or tag-only across the 6 sites; today only the installer pins by digest.

References

• PR fix(installer): bootstrap cozy-system via --create-namespace + label hook #2508 review thread (lexfrei) — origin of this issue.
• endoflife.date/kubernetes — minor EOL schedule.
• Docker Hub: alpine/k8s tags.