fix(marketplace): connecting a repository installs its components, and Flux installs them as cluster-admin #4978

Summary

For every PackageSource it materializes, tap materializer calls ensureRegistration (tapmaterializer_reconciler.go L181). It creates Package named after the source with default variant and ignores AlreadyExists (L456-L473). Package reconciler then creates HelmRelease for every component of that variant that has install block, not only for charts that back ApplicationDefinitions. So connecting a repository installs charts publisher chose. With scaffold from cozypkg init installed component is <app>-rd with install.namespace: cozy-system (init.go L70-L85), arbitrary Helm chart rendered into cozy-system.

Those HelmReleases run under Flux service account flux, bound to cluster-admin (fluxcd.yaml L7831-L7847). Manifest doesn't set --default-service-account, and internal/operator and pkg/registry/apps never set serviceAccountName on HelmRelease, so there is no impersonation.

privileged is declared by publisher in the same artifact. It is a prompt for admin, doesn't protect against publisher who wants to do harm.

Second effect of the same call: ensureRegistration runs when new revision is materialized, so registration Package that admin removed with cozypkg del is created again on next revision.

Impact

Creating Tap needs cluster admin, tenant roles have only get, list and watch on taps (clusterroles.yaml L47-L52). So this is admin connecting repository they chose, but 1.7 docs say "tapping itself installs nothing", and connect actually runs publisher's charts as cluster-admin with no extra step. Confirmation gate for privileged components exists (#4308), but it is racy (#4359) and doesn't cover later revisions of handed-over Package (#4358).

Read in code, not reproduced on a cluster.

Suggested fix

For a 1.7.x patch:

• Remove ensureRegistration call, or put it behind its own flag that is off by default. Connecting then only materializes PackageSources, installing is explicit cozypkg add or dashboard action.
• Consequence to accept: apps from connected repository appear in catalog only after admin adds them. If flag route is chosen, re-creation of deleted Package stays in that mode.

Long term #4359 proposes producing catalog from PackageSource metadata instead of from an install. I think that is the right shape, this issue is the smaller step.

Acceptance

• Connecting repository creates no Package, HelmRelease or ApplicationDefinition.
• Package removed with cozypkg del stays removed across new revisions.
• #4358 and #4359 stay open for long term design.