[Epic] Split cozystack into platform and catalogs: step 0 #4982

Design proposal: community#106

Step 0 is work that removes a forbidden edge between platform and catalogs or fixes something a contract K1-K6 relies on, and needs no new mechanism, so it starts before the proposal is accepted. Items without a number get their issue soon, I will link them here.

Policy and lint

• Contribution policy for new applications in CONTRIBUTING.md (after the proposal is accepted)
• Boundary lint in CI, baseline mode

Backups

• RestoreJob fails on a strategy from another API group instead of skipping it, like BackupJob does
• Driver registry instead of the switch on application kind in the backup controller

RBAC and monitoring

• Tenant roles for application kinds come from the *-rd charts through aggregation labels, not from the list in cozystack-basics
• KubeVirt network policies move from the tenant chart to virtualization as cluster-wide policies
• Application dashboards ship from application charts, monitoring picks them up by label

API and operator

• cozystack#4976 One invalid ApplicationDefinition stops cozystack-api from starting
• cozystack#4975 Package reconciler takes over a HelmRelease it does not own
• ApplicationDefinition reconciler re-applies the sharding label to every release
• One place that builds HelmRelease specs for the API, the AD reconciler and the operator (symptom: cozystack#4409)

Tenant values

• Root tenant values reference modules it never enabled, and the two _namespace writers disagree (etcd case: cozystack#4783)
• etcd module renders Kamaji DataStore without a capability check

Virtualization

• forklift and migration-controller have no PackageSource
• Per-cluster etcd for tenant Kubernetes, after community#25 is accepted

Dashboard

• Sidebar icons from the ApplicationDefinition
• Sidebar categories ordered by dashboard.weight (free categories landed in cozystack#4741)
• spec.dashboard.visibility instead of special cases, after community#39
• Migration section only when the forklift API is served
• Backup bucket from backup configuration instead of hardcoded cozy-backups

Marketplace

Marketplace ships enabled in 1.7, its defects are fixed in 1.7 patch releases and tracked in cozystack#4981. Open items: artifact name collisions cozystack#4977, install on connect as cluster-admin cozystack#4978, pinning taps by digest cozystack#4979, disconnect without checking instances cozystack#4980. HelmRelease takeover and the invalid ApplicationDefinition item above go first, because they also hit the 1.6 path with PackageSource and cozypkg add.

Cleanups found on the way that do not block the split (tenant naming rule, dead tap RBAC, tap cascade deletion and similar) are filed separately with priority/backlog.