[RiRa12621]

What this PR does / why we need it:

Add gated STACKIT worker support to HyperShift using Cluster API Provider STACKIT (CAPSTK). HostedClusters reference an existing project, region, network and credential Secret; NodePools create STACKIT machine templates with an explicit RHCOS image. A separate Machine API provider is not needed.

The change includes namespace-scoped provider deployment, credential rotation and cleanup retention, bootstrap Secret retention, a hosted STACKIT cloud controller with a dedicated guest identity, External infrastructure configuration, cluster/node-pool CLI commands, admission tests and a future lifecycle smoke-test adapter. STACKITPlatform is disabled by default and available with TechPreviewNoUpgrade. Existing platforms retain their serialized configuration and machine-template hashes.

Which issue(s) this PR fixes:

No Jira issue. This personal-fork draft is for manual review before approaching upstream maintainers.

Special notes for your reviewer:

• This is WIP, not a production certification. Validation is local only, as requested; no live STACKIT project or management cluster was used.
• Requires the companion CAPSTK WIP draft for namespace-scoped management and safe credential recovery during deletion. CAPSTK API types are pinned to upstream commit 9d68b5c14d980dfd83bb573f1adb679f1de040bd; controller images must contain the companion changes.
• Supply explicit HyperShift/CPO, CAPSTK and Kubernetes-compatible STACKIT CCM images. No unverified image defaults are added.
• A compatible RHCOS image must be built and boot-tested. Native STACKIT support in Ignition and Afterburn is pending upstream; this change does not establish a supported release/image combination.
• Guest CSI installation is separate and user managed. Registry storage is manual. Delete workload volumes and application load balancers before cluster teardown and verify cloud cleanup: HyperShift's existing guest-resource cleanup can time out or be skipped. Storage, ingress, replacement, upgrades, credential rotation and complete cloud teardown need live validation before promotion.
• All contributions remain in RiRa12621's forks. Upstream design feedback, CI ownership and promotion are deferred until manual review.

Local validation (Go 1.26.3 for final HyperShift build/lint and final reruns; earlier focused race tests also used the installed Go 1.27.0; no cloud tests):

• Built all six production binaries, the end-to-end test binaries, and every repository test package (go test -p 2 -o /dev/null -c ./...) using disk-backed GOTMPDIR.
• Main and API lint: 0 issues. The final initial-credential-failure/deletion regression passed with -race; its scoped lint also passed. Final full installer, CRD-asset and API serialization package race tests passed with a 30-minute timeout. The operator binary was rebuilt after the last fix.
• STACKIT Kubernetes 1.35 envtest: 88 admission cases passed, plus 15 feature-gate isolation checks.
• Race tests passed for the STACKIT platform adapter, HostedCluster and NodePool reconciliation, CLI commands, credential watching/recovery, bootstrap retention, infrastructure configuration, image overrides, cloud-controller rendering and guest RBAC. Existing platform serialization and template-hash compatibility are covered.
• Full ordinary tests passed for the affected control-plane packages. The broad HCCO race run exceeded its default 10-minute limit in existing bcrypt password tests; focused STACKIT HCCO race coverage passed. Local socket-dependent controller tests passed when rerun outside the sandbox.
• Regenerated CRDs, clients, deepcopy, API reference, aggregate docs and vendor contents. CRD schema verification (14 CRDs), API dependency checks, spelling and docs navigation passed.

The full make pre-commit gate is not recorded as passing: its all-test linking stage exhausted the 16 GiB /tmp filesystem (the complete compilation retry passed with disk-backed temporary storage), and the earlier make update attempt exposed API-module/vendor drift after workspace-sync. Generation was completed separately while retaining baseline dependency versions. A complete upstream CI run remains required before promotion.

Checklist:

• Subject and description added to commits and PR.
• Related provider and image work referenced.
• This change includes docs.
• This change includes unit and admission tests.
• Live lifecycle and production readiness validated.
• Upstream design and CI ownership agreed after manual review.