[Backport release-1.6] fix(kubernetes): break bootstrap-token Job out of Helm hook to unblock fresh installs - #4541

What this PR does

Backports #3887 to release-1.6. The fix reached main only: v1.6.3 and v1.6.4 both still ship the bootstrap-token Job as a post-install,post-upgrade Helm hook, and git tag --contains on the merge commit returns v1.7.0-alpha.1 and nothing from the 1.6 line. Tracked as #4539.

#3875 describes the deadlock this removes: the chart upgrade waits for MachineDeployment and the child HelmReleases, workers cannot register without the bootstrap-token-<id> Secret in the guest cluster, and the hook that creates that Secret only runs once the wait has already succeeded. The wait cannot succeed without nodes, so the upgrade times out and Flux retries the same cycle indefinitely.

It is deterministic rather than flaky, and it takes out every tenant Kubernetes cluster on the platform at once. What makes the backport worth filing separately: anyone hitting this on 1.6.3 finds #3875 closed in the tracker, upgrades to 1.6.4 expecting the fix, and lands in exactly the same state.

Observed on a production cluster before the manual workaround: machines stuck in Provisioned with no NODENAME, VMIs Running with IPs assigned, guest clusters reporting No resources found for nodes, and no bootstrap-token Secret anywhere in the guest kube-system. Creating the Secret by hand brought nodes up within 90 seconds on each affected tenant.

git cherry-pick --mainline 1 of the merge commit applied cleanly with no conflicts, and nothing was changed on top: the diff here is identical to what merged on main.

Validation, helm unittest in packages/apps/kubernetes including tests/talos_templates_test.yaml which this change extends:

Charts:      1 passed, 1 total
Test Suites: 19 passed, 19 total
Tests:       189 passed, 189 total

Screenshots

Not applicable, no UI changes.

Downstream repositories

• No downstream repository is affected by this change
• cozystack/website - follow-up:
• cozystack/terraform-provider-cozystack - follow-up:
• cozystack/ansible-cozystack - follow-up:
• cozystack/ccp - follow-up:
• cozystack/talm - follow-up:
• cozystack/cozyhr - follow-up:
• cozystack/cozy-proxy - follow-up:
• cozystack/cozystack-telemetry-server - follow-up:
• cozystack/external-apps-example - follow-up:
• cozystack/examples - follow-up:

Release note

fix(kubernetes): create the tenant bootstrap-token Secret outside the Helm hook, so Talos workers can register during a chart upgrade instead of deadlocking against the wait that needs them