Backfill tenant.cozystack.io/<ancestor> labels on existing tenant
namespaces so clusters heal on upgrade without waiting on each tenant
HelmRelease to re-reconcile (#2810/#2171).

Backport of migration 49 from #2912, adapted for release-1.5:
- migration file 49 -> 46. The existing backport PR #3191 renumbered it to
  45, but the SeaweedFS repair migration backported alongside it (#3339 /
  #3370) claims 45 too, so the two collide. Whichever of those two PRs
  merges second has to take 46; here the SeaweedFS one keeps 45 because it
  is what the 1.5.x line is being cut for.
- targetVersion 45 -> 47, covering both new migrations. #3191 alone bumps it
  to 46, and because the two backports agree on that value git merges them
  without a conflict — leaving targetVersion one short of the highest
  migration, which run-migrations.sh silently skips (its loop stops at
  TARGET-1). release-1.5 has no `migrations-target-check` to catch it; that
  guard arrived on main after v1.5.2 and was never backported.
- stamp via the inline labeled-ConfigMap apply used by release-1.5
  migrations, since lib/cozystack-version.sh does not exist on this branch

Best-effort and idempotent: kubectl label --overwrite adds only the listed
labels, and per-namespace failures are tolerated so a transient apiserver
error cannot abort the platform upgrade.

(cherry picked from commit 50f78ce)

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
(cherry picked from commit aee9fa85b65d96dae1dff7e5044fd26ce710797e)

…on and in the chart (#3892)

Migration slot 45 holds a different migration here than on main and
release-1.6. On this branch it is the seaweedfs db-split repair, added
after v1.5.3 by `33611dfe7` (the #3370 backport), which in the same
commit bumped `migrations.targetVersion` from 45 to 46. On main and 1.6
slot 45 is the `helm.sh/resource-policy=keep` pin on
`KubeadmConfigTemplate`, and the seaweedfs repair sits at slot 53
instead.

Nothing is broken today. v1.5.0 through v1.5.3 all ship `targetVersion:
45`, so no released cluster is stamped past it and every one of them
still runs 1.6's slot 45 on the way up. Cutting v1.5.4 is what first
ships 46. After that a 1.5.4 to 1.6 upgrade runs `seq 46 53` and never
executes 1.6's slot 45, so helm prunes `KubeadmConfigTemplate` while the
live kubeadm-backed MachineSet still references it,
`bootstrap.configRef` dangles and controller-manager floods through the
talos worker rollover. Tenant kubernetes only, noisy broken upgrade
rather than data loss.

This folds the keep-pin into release-1.5's slot 45 so it does both jobs,
and puts the annotation on the rendered template in
`packages/apps/kubernetes/templates/cluster.yaml` so templates created
after the upgrade are born pinned. `targetVersion` stays 46.

### Why uninstall does not leak

`keep` suppresses only helm's own delete. CAPI stamps an
`ownerReference` to the `Cluster` on this object, which the chart does
not render (checked on a live v1.5 stand, and `MachineDeployment` and
`KubevirtMachineTemplate` carry the same reference). The `Cluster`
itself is helm-managed with no `keep`, so `helm uninstall` deletes it
and GC reclaims the template through that reference.

Template name is deterministic rather than content-hashed, so `keep`
cannot accumulate a copy per upgrade. One residue is the template of a
removed nodeGroup, which helm no longer prunes. It is inert, re-adopted
in place if the group comes back, and GC takes it with the `Cluster`.

### Tests

Mutation-proven rather than revert-tested. The one worth naming:
swapping the selector to the `meta.helm.sh/release-name` annotation
makes the migration exit 0 reporting `pinned=0 failures=0`, which looks
like a clean run, and the test catches it because the annotation never
reached the object.

Also converts four pre-existing negated-grep assertions in
`hack/seaweedfs-guard-parity.bats`. `! grep -q X f` cannot fail, posix
and bash both exempt a `!`-negated pipeline from errexit, so those were
comments that look like assertions. All of them hold once they are real.