platform: networking variant guard misses non-render paths and refuses switches that delete nothing #4883

The networking variant guard from #4790 stops a CNI-deleting switch only when the platform chart renders, and it also stops switches that delete nothing. Both gaps came up in review and were left out of that PR on purpose.

The deletion itself happens in the operator. cleanupOrphanedHelmReleases in internal/operator/package_reconciler.go removes the HelmReleases the stored spec.variant no longer installs, on every reconcile. Editing the cozystack.networking Package directly, by kubectl or through the UI, or a helm-controller rollback of the platform release, reaches that code with no platform render, and the Package CRD has no validation on spec.variant. A plain CEL immutability rule would also block the switches networking.acknowledgeVariantChange is there to allow, so the check needs its own way to confirm a switch, for example a webhook that compares the release sets. Review thread: #4790 (comment)

The guard compares variant names, so it refuses switches that keep every release. kubeovn-cilium and kubeovn-cilium-generic install the same components, so do cilium and cilium-generic, and noop installs nothing, so isp-hosted to isp-full deletes nothing either. All of these need the acknowledgement today. Comparing the components of the live variant with the target's would let them through. Review thread: #4790 (comment)