postgres: init-job and its pod are not cleaned up after release deletion #3055

Describe the bug

After deleting a Postgres app CR, the chart-managed init Job <release>-init-job and its completed Pod remain in the tenant namespace indefinitely.

Environment

• Cozystack version: v1.4.0-rc.2
• Provider: on-prem (bare-metal)

To Reproduce

1. Create a tenant, deploy Postgres/test.
2. Wait until the HelmRelease is Ready.
3. Delete the Postgres CR; wait ~120s.
4. kubectl -n <ns> get job,pod | grep init-job — the Job and its Pod are still present.

Expected behaviour
After the app CR is deleted, no orphaned Job/Pod remain.

Actual behaviour

job.batch/postgres-test-init-job          Complete
pod/postgres-test-init-job-xxxxx          Completed

Additional context

• Root cause: packages/apps/postgres/templates/init-job.yaml:18-21. The Job is a Helm hook (post-install,post-upgrade) whose only delete policy is before-hook-creation. That policy deletes the previous hook resource only right before a new one is created (next install/upgrade) — it does not delete on helm uninstall. Helm only reaps hook resources on uninstall when hook-succeeded/hook-failed is present. Neither is set, and there is no ttlSecondsAfterFinished for Pod GC.
• Proposed fix (init-job.yaml:21):

  "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed

  Optionally add ttlSecondsAfterFinished: 300 to the Job spec.

Found during a create→delete leak sweep of all 22 apps on Cozystack v1.4.0-rc.2.