chore: keep KB-managed tools image updates in-place

[leon-ape]

Summary

• keep KB-managed tools image-only updates in-place even when podUpgradePolicy is ReCreate
• cover kbagent, kbagent-worker, init-kbagent, and legacy config-manager tools containers by fixed container name plus KBToolsImage repo/name
• document ComponentDefinition ReCreate precedence over user Cluster/Component podUpgradePolicy and regenerate CRDs

Root Cause

KubeBlocks-managed sidecar/tools image changes were classified as container/initContainer upgrade diffs. When the resolved podUpgradePolicy was ReCreate, the update reconciler converted an otherwise in-place image update into Pod deletion and recreation.

Validation

• make test-go-generate
• make manifests
• go test ./pkg/controllerutil ./pkg/controller/instanceset ./pkg/controller/instance ./controllers/apps/component

Fixes #10472

[apecloud-bot]

Auto Cherry-pick Instructions

Usage:
  - /nopick: Not auto cherry-pick when PR merged.
  - /pick: release-x.x [release-x.x]: Auto cherry-pick to the specified branch when PR merged.

Example:
  - /nopick
  - /pick release-1.1

CLA Recheck Instructions

Usage:
  - /recheck-cla: Trigger a re-check of CLA status for this pull request.
Example:
  - /recheck-cla

[codecov]

Codecov Report

❌ Patch coverage is 82.07547% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.54%. Comparing base (84e21fd) to head (834f574).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/controllerutil/image_util.go	72.72%	10 Missing and 5 partials ⚠️
pkg/controller/instance/in_place_update_utils.go	83.33%	2 Missing and 1 partial ⚠️
pkg/controller/instance/reconciler_update.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10484      +/-   ##
==========================================
+ Coverage   63.40%   63.54%   +0.13%     
==========================================
  Files         517      517              
  Lines       62542    62636      +94     
==========================================
+ Hits        39657    39799     +142     
+ Misses      19304    19260      -44     
+ Partials     3581     3577       -4     

Flag	Coverage Δ
unittests	63.54% <82.07%> (+0.13%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[leon-ape]

[P2] This helper treats initContainer image changes as safe in-place updates, but already-completed init containers are not re-executed when their PodSpec image is patched. For init-kbagent, kbagent-worker, or install-config-manager-tool, the controller can bypass a ReCreate policy, patch the spec, and then consider the pod updated even though the init-time tool/binary remains from the old image. Please keep the ReCreate path for initContainer-only KB tools image changes, or otherwise prove that a normal running container restart applies the new tool payload.

[leon-ape]

/approve