fix(marketplace): disconnecting a repository removes its application definitions without checking tenant instances #4980

Summary

Disconnect from dashboard or API (rest.go L299-L390) deletes tap-managed registration Package first. Comment in code says what that does, it "garbage-collects the registration HelmReleases and their ApplicationDefinitions". Then it deletes PackageSource, and Flux OCIRepository when nothing else references it. cozypkg untap does the same (tap.go L405-L446). Neither looks at tenant application instances of the kinds this source provides.

Publisher can trigger the same removal remotely. After materializing revision, materializer prunes every PackageSource of that tap that new revision no longer contains (tapmaterializer_reconciler.go L193-L199). Registration Package has ownerReference to its PackageSource (registrationOwnerRef, L466), so pruning source removes Package, its HelmReleases and ApplicationDefinitions as well. Revision without a PackageSource is enough.

Impact

After ApplicationDefinition and artifacts are gone, kinds disappear from apps API and existing instances lose the chart they were built from. I read the removal mechanism in code, what it does to a running tenant application I did not run.

Suggested fix

• Refuse Disconnect, cozypkg untap and revision prune while tenant instances of any kind provided by this source exist. Tap object already maps packages to kinds (buildTap with appDefIndex), that gives the list of kinds to look for.
• Force option for admin who really wants to remove everything.
• For prune keep PackageSource and report condition on tap instead of deleting it, so publisher can't remove running applications by publishing a revision.

Dashboard texts

Two texts in TapsPage.tsx say things the code doesn't do.

Disconnect confirmation, L42: "Disconnect repository ...? Installed packages stay installed." Since #4308 disconnect deletes registration Package, its HelmReleases and its ApplicationDefinitions, only Package that user pinned stays. New text should say what is removed, and that disconnect is refused while instances exist, so write it together with the refusal above.

Trust banner, L66, says "The index verifies signatures at publication time" and then that connecting does not verify them. Second half is true. First half describes index that doesn't exist, there is no default index, cozystack/packages-index repository doesn't resolve and publication gate can't run. Drop first sentence and keep "connecting does not verify signatures". This one doesn't depend on the refusal and can go first.

Acceptance

• Disconnect and untap fail with message naming instances while instance of kind from the source exists. With force option they proceed.
• New revision without PackageSource leaves existing one in place and sets condition on tap while instances exist.
• With no instances behaviour is unchanged.
• Repositories page makes no statement that code contradicts.