[EPIC] Publish Kustomize bases #3169

Goal

Every release publishes the install as kustomize bases that kubectl apply -k and GitOps tools can apply directly. The bases are generated from the same tree and render that ate-setup uses. Everything ate-setup deploy does beyond rendering has a declarative equivalent, so no install path needs ate-setup.

General Requirements

• Add a repeatable flag that applies caller-supplied kustomize Components on every render path ([FEATURE] Add --component flag for kustomize manifests #3167).
• Give every install setting a documented manifest and key ([FEATURE] Establish cluster-side install setting records #3172).
• Add an ate-setup render command that writes the fully resolved install ([FEATURE] Add an ate-setup render command #3240).
• Add a bootstrap Job that only creates keys and runs safety checks. It depends on no workload and is safe to rerun (contract [FEATURE] Install Bootstrap #3175; implementation [FEATURE] ate-setup bootstrap command and keys-only bootstrap Job #3676).
• Let bundled Postgres create its own database identities at startup, so nothing has to exec into it (contract [FEATURE] Extensible DB Identity Setup #3184; implementation [FEATURE] Bundled Postgres creates its own database identities at startup #3677).
• Define install ordering for fresh installs ([FEATURE] Generate the release layout from ate-setup render #3678, [FEATURE] Kind CI: install, upgrade and roll back from release bases with kubectl only #3679):
  • CRDs first;
  • then bootstrap;
  • then everything else in one apply.
• Publish one base per upgrade step, so upgrades follow the version skew policy (contract [FEATURE] Release Layouts #3176; implementation [FEATURE] Generate the release layout from ate-setup render #3678, CI [FEATURE] Kind CI: install, upgrade and roll back from release bases with kubectl only #3679).
• Replace imperative restarts and deletes with declarative equivalents that keep object names stable (contract [FEATURE] Settings change and removal mechanism #3663; implementation [FEATURE] Replace ate-setup's imperative restarts and deletes with declarative equivalents #3680).
• Release workflow: on each tag, publish images and commit the rendered bases on the tag (Publish pullable images and a pre-built install for each release #2730). Images publish from v1.0.0-rc.1; coordinates in [FEATURE] Release coordinates for images, bases, charts and binaries #3664.
• Typecheck the command-line tool on other platforms, and decide whether releases publish its binaries (Should non-CLI components build or run on non-Linux platform #2517, [FEATURE] Release coordinates for images, bases, charts and binaries #3664).
• Follow-up: make the source tree usable with plain kustomize, without the render step ([FEATURE] Make the manifest source tree a valid kustomize base without render #3681).

Tracks the Publish the install as kustomize bases workstream of the Extensible Install Roadmap.

Parent Issue: #3158