feat(openshift): add SCC-managed deployment profile

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Part of #206. Depends on #215 for Tenant workload delegation. The RBAC repair is split into #214.

Summary of Changes

• add an opt-in openshift.enabled Helm value, defaulting to false
• omit chart-managed Pod and container security contexts from Operator, Console, and optional split frontend Deployments when enabled, allowing SCC to assign runtime identities
• add a MinIO-style Tenant example using the paired empty security-context contract
• document restricted-v2 scope, arbitrary-UID image requirements, upgrade ordering, preflight inventory, rollout behavior, storage risks, and rollback constraints in English and Chinese
• add values-schema and manifest contract tests

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased] (if user-visible change) — N/A; this repository does not currently contain CHANGELOG.md
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: default-off OpenShift installation profile; enabling it rolls control-plane Deployments

Update impact

• Default behavior is unchanged. Existing installations and upgrades with openshift.enabled=false render the current fixed Operator/Console security contexts.
• Enabling the profile changes the Pod templates and rolls the Operator and Console Deployments. It does not directly rewrite Tenant or PVC API objects.
• The optional split frontend also omits its container security context when enabled, but the stock nginx image has not been verified for arbitrary UID, writable runtime paths, and unprivileged port binding. Keep it disabled until a compatible image is supplied and tested.
• Tenant workload delegation requires feat(operator): delegate paired empty security contexts #215. Applying the example before a controller containing feat(operator): delegate paired empty security contexts #215 leaves the old 10001 behavior in place.
• After feat(operator): delegate paired empty security contexts #215, converting an existing Tenant/Pool to the paired {}/{} form rolls the affected StatefulSet. A changed SCC-assigned FSGroup can trigger first-mount ownership work; large volumes can start slowly, and incompatible CSI/root-squash permissions can fail.
• The upgrade order is: inventory existing paired empty objects, apply the CRDs, upgrade the Chart with openshift.enabled=true, wait for Operator/Console rollout, validate SCC/image/storage prerequisites, then migrate Tenant manifests in a maintenance window.
• Disabling the profile or rolling back reintroduces fixed Operator/Console identities and rolls those Deployments. Do so only when the namespace SCC permits the fixed IDs.

OpenShift release blockers and support boundary

• This is SCC-compatible manifest delivery, not an OpenShift certification claim.
• Current support is limited to restricted-v2; restricted-v3 spec.hostUsers: false is not implemented.
• Current RustFS server images use /data and /logs ownership 10001:10001 with mode 0750. A separate arbitrary-UID image fix and real OpenShift data read/write, existing-PVC, rollout, and rollback validation are required before end-to-end support can be declared.
• The local environment did not provide Helm, so Helm-dependent assertions were skipped locally by the test harness. CI must run them with Helm installed before merge.

Verification

make pre-commit
cargo test --manifest-path e2e/Cargo.toml --test openshift_manifest --test sts_manifest
cargo clippy --manifest-path e2e/Cargo.toml --all-targets -- -D warnings

Additional Notes

This PR intentionally avoids adding a Console Tenant mode button. The current Console API is Tenant-scoped while the MinIO contract is Pool-aware; YAML remains the lossless configuration path until a Pool-aware API can preserve advanced security fields.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.