vm-disk: golden-image clone guard may refuse clones that would bind #4884

The golden-image clone guard in vm-disk (#4796) can refuse a clone that would bind. It refuses a same-provisioner clone into a LINSTOR class without remote access from every node, and it reads neither the class binding mode nor where the golden image's replicas live.

Two cases are likely refused for nothing. A class with Immediate binding, where the requisite topology may already cover every node. And a clone placed on a node that already holds a replica of the golden image. Both have a way out (the golden image's class, or cloneStrategyOverride: copy), and existing disks are exempt, so this does not block upgrades.

The first step is to confirm the Immediate case against external-provisioner and linstor-csi, then narrow the condition in packages/apps/vm-disk/templates/dv.yaml if it holds. Review thread: #4796 (comment)