Changing the platform variant on a live cluster can delete its CNI #4596

Changing the platform variant on a running cluster can remove its CNI, and nothing stops it. The platform chart accepts the new variant and re-renders the cozystack.networking Package with a different networking variant.

The operator then reconciles that Package against the new variant's components. cleanupOrphanedHelmReleases in internal/operator/package_reconciler.go deletes every HelmRelease labelled with the Package that the new variant does not list. Moving from isp-full to isp-hosted puts networking on noop, which deletes the cilium and kubeovn releases. Every pod on the cluster loses networking.

The other platform Packages don't have this problem, because they carry helm.sh/resource-policy: keep and stay when the platform stops rendering them. Networking is different: the Package stays, its variant changes, and the reconciler removes what the old variant installed.

The slim variants in #4595 add one more path into this. Moving isp-full to isp-slim switches networking from kubeovn-cilium to cilium and removes Kube-OVN.

A fix could be a lookup in packages/core/platform/templates/bundles/system.yaml that fails the render when the live cozystack.networking Package has a different variant than the one about to be rendered, unless an explicit acknowledge value is set. publishing.proxyProtocolAcknowledgeUnclean in the same file is a guard of the same shape.