[FEATURE] Generate the release layout from ate-setup render #3678

Produces the release/ tree defined by the release layout contract (#3176) from ate-setup render (#3240): CRDs, bootstrap, the fresh-install system/ kustomization, one base per upgrade stage, and the sizing Components. Until render lands, maintain a sample of the tree for the Helm workstream to build against.

Tracks "Define install ordering and upgrade stages" in the Publish the install as kustomize bases workstream of the Extensible Install Roadmap.

Required changes

• A command, or render mode, that writes release/{crds,bootstrap,system,stages/<n>-<name>,components/sizing-*}, with each directory a valid kustomization, images pinned to digests, and no text placeholders.
• ate-idp-server and bundled Postgres go in 4-apiserver (resolved in ate-setup: deploy ate-idp-server with ate-api-server #2891).
• Each release ships its SandboxConfig under its own name, with helm.sh/resource-policy: keep ([Bug Bash] Install a new SandboxConfig per release instead of updating the class default in place #3253, [Bug bash] Make sure each release creates sandbox config to enable rollback #3254).
• Shared settings objects consumed by several stages (for example ate-otel-config) ship in bootstrap/.
• Check in a sample of the tree. Regenerate it in the same change as any layout change, and fail CI when the sample and the real render differ.

Dependencies: #3240 (render), #3676 (bootstrap manifests), #3168 (sizing Components).

Enforcement

• Every directory builds with kubectl kustomize.
• CI compares the sample with the real render.

Parent Issue: #3169