[FEATURE] Replace ate-setup's imperative restarts and deletes with declarative equivalents #3680

Implements the settings change and removal mechanism (#3663). Workloads roll when their settings change, and disabled components are removed, without ate-setup and without renaming objects.

Tracks "Replace imperative restarts and deletes" in the Publish the install as kustomize bases workstream of the Extensible Install Roadmap.

Current state (0b635b80)

• env-hash annotation: cmd/ate-setup/internal/steps/apienv.go.
• Rollout restarts: steps/overlay.go and steps/csi.go.
• Credential-provider delete: steps/credprovider.go.
• [bug-bash] ate-setup deploy ate-system is not idempotent: atenet-router and atenet-egress restart on every run #3219: atenet-router and atenet-egress restart on every deploy ate-system.

Required changes

• Implement the mechanism chosen in [FEATURE] Settings change and removal mechanism #3663 in the render output, so the same annotation or reload drives every install path.
• Remove the imperative restarts and deletes from ate-setup.
• Document a kubectl delete (or prune) per optional component.
• Never prune SandboxConfigs.

Dependencies: #3663 decision; #3240.

Enforcement: CI changes the database connection string and the OpenTelemetry endpoint through each install path and asserts exactly the consuming workloads roll. A redeploy with no changes restarts nothing.

Parent Issue: #3169