[FEATURE] atelet image credential provider becomes a documented install setting #3667

atelet's image credential provider is configured by two GKE host-path volumes and two flags in the base DaemonSet. Make that a named, documented setting that kustomize patches, Helm values, and provider Components override, and record the default.

Tracks "Make atelet's credential-provider paths a documented setting" in the Provider-Neutral Core workstream of the Extensible Install Roadmap.

Current state (0b635b80)

• manifests/ate-install/atelet.yaml mounts host paths /home/kubernetes/bin and /etc/srv/kubernetes/cri_auth_config.yaml as volumes image-credential-provider-bin and image-credential-provider-config, and passes --image-credential-provider-config and --image-credential-provider-bin-dir.
• atelet treats an empty flag as anonymous pulls (cmd/atelet/main.go).

Required changes

• Record the default decision. [Bug]: atelet credential-provider configuration is hard-coded to GKE host paths #2669 holds the discussion: keep GKE's host paths as the default (lower friction) or default to no credential provider (anonymous pulls).
• Expose the volumes and flags as a single setting in the install settings contract ([FEATURE] Establish cluster-side install setting records #3172) and the Helm values contract ([FEATURE] Base Helm Values for Installers #3186): atelet.imageCredentialProvider.{enabled,binDir,configFile}.
• The volume names stay stable patch targets ([FEATURE] Create contractual object names for Provider-based Patching #3188).
• If the default becomes "none", the GKE Component in substrate-gke adds the paths back (Complete the GKE kustomize Component ai-on-gke/substrate-gke#152), and the removal ships after the GKE parity release (GKE parity release: install through the GKE Component ai-on-gke/substrate-gke#151).

Dependencies: the decision in #2669. Changing the default waits for ai-on-gke/substrate-gke#151.

Breaking change: only if the default changes. Needs a release note.

Enforcement

• Render test overrides each field of the setting.
• With the setting disabled, atelet starts and pulls public images anonymously on kind.

Parent Issue: #3161