[FEATURE] Run the install bootstrap as Helm hooks #3685

Run the keys-only bootstrap Job (#3676) and its prerequisites as pre-install and pre-upgrade hooks that are safe when Argo CD reruns them on every sync.

Tracks "Run bootstrap as Helm hooks" in the Helm Charts workstream of the Extensible Install Roadmap.

Required changes

• Hooks with ordered weights for the bootstrap RBAC and Job. bootstrap.enabled=false disables them.
• Namespaces: do not ship them as hooks with before-hook-creation, because that deletes ate-system and podcertificate-controller-system on every upgrade (see the 2026-11-05 comment on [FEATURE] Install Bootstrap #3175). Choose between:
  • a create-if-missing namespace Job at an earlier weight;
  • namespaces as helm.sh/resource-policy: keep objects in a chart installed before the bootstrap.
• A guard refusal (exit 2) fails the hook, and the upgrade stops before anything changes.

Dependencies: #3676; the namespace decision on #3175.

Enforcement

• Chart CI runs install and upgrade twice and asserts the key Secrets and namespaces are unchanged.
• A forbidden database switch fails the hook.

Parent Issue: #3170