The default Strategy CRs and the Velero BackupStorageLocation are
templated behind a `lookup` of the BucketClaim the same chart creates,
because the COSI driver assigns the real S3 bucket name
(`bucket-<claim-UID>`) and it cannot be computed at render time. On a
fresh install that lookup is empty, so those templates render nothing.

helm-controller does not re-render a release that succeeded and whose
chart and values did not change, and drift detection is off on
operator-generated HelmReleases, so the skip is permanent: a cluster
that loses the install-time race keeps `BackupClass cozy-default` with
no Strategy CRs and no Velero BSL indefinitely.

Add a DefaultObjectsGate runnable that, once the bucket name is
resolvable from the credentials projector's source Secret, verifies
that every object the BackupClass routes to exists and stamps both
reconcile.fluxcd.io/forceAt and reconcile.fluxcd.io/requestedAt on the
HelmRelease to force the real Helm upgrade that re-runs the lookups.
requestedAt alone is a no-op for an unchanged release, so both
annotations are required. Two Prometheus metrics expose the state
independently of the HelmRelease Ready condition.

Also make the per-user bucket credentials template fail loudly instead
of silently skipping when the source Secret is absent, so this class of
race surfaces as a failed release rather than as a missing Secret.

Backport of #3524 to release-1.5. The conflict in
docs/operations/backup-classes.md was resolved to the post-fix wording:
the pre-fix text claimed Flux repairs the skip on its interval
reconcile and told operators to run `flux reconcile helmrelease`, which
is precisely the misconception this change corrects.

Signed-off-by: Mattia Eleuteri <[email protected]>
Signed-off-by: Myasnikov Daniil <[email protected]>