fix(base): replace ensureLease init container with pre-install hook Job

[davidf-null]

Problem

The ensure-lease init container in the nullplatform-log-controller DaemonSet pulls bitnami/kubectl from Docker Hub on every pod startup. Since a DaemonSet runs one pod per node, a cluster with N nodes triggers N image pulls per deploy — causing Docker Hub rate limit errors reported by customers.

Additionally, lease.yaml was a regular Helm template, causing Helm's SSA to conflict with the k8s-logs-controller over holderIdentity on every upgrade (revisions 3, 5 in minikube history showed this exact failure).

Changes

• daemonset.yaml: Remove ensure-lease init container entirely — eliminates all Docker Hub pulls from the DaemonSet
• pre-install-lease.yaml (new): Hook Job (pre-install,pre-upgrade) that creates the Lease once per Helm operation, regardless of node count. Controlled by existing logging.ensureLease flag
• lease.yaml: Convert from regular template to pre-install hook — Helm creates it on install only, never SSA-applies it on upgrade. Removes holderIdentity from spec so the controller has full SSA ownership
• serviceaccount.yaml / clusterroles.yaml / clusterrolebindings.yaml: Add hook RBAC (hook-weight: -5) for the new Job SA

ArgoCD compatibility

• Hook resources are excluded from ArgoCD's desired state — no more drift loop where ArgoCD fights the controller over holderIdentity
• The hook Job maps to ArgoCD's PreSync phase, which is the correct behavior (Lease exists before DaemonSet pods start)

Test plan

• helm template --set logging.ensureLease=true renders Job hook + RBAC, no initContainers in DaemonSet
• helm upgrade --set logging.ensureLease=true on minikube — Job completes, Lease created (lease.coordination.k8s.io/nullplatform-metrics-extractor configured)
• Two consecutive upgrades succeed without SSA conflict (previously failed on rev 3, 5, 8)
• helm template (default ensureLease=false) renders zero lease-installer resources

🤖 Generated with Claude Code