chore: bump netbird to 0.78.2, keycloak to 26.7.4; revive upstream checker

[mikkeldamsgaard]

Folds in this round's issues: #139 (netbird), #140 (keycloak) — plus the reason those issues almost didn't exist.

1. Fix: the upstream version checker was silently dead

The daily upstream-check.yaml schedule stopped on 2026-08-23: GitHub disables cron-scheduled workflows after 60 days without repository activity (the repo was quiet from June 23 to Aug 29), and never re-enables them. Result: no update issues were filed for almost a month while upstream shipped netbird 0.78.x and keycloak 26.7.3/26.7.4.

• Re-enabled the workflow and dispatched it manually — it immediately filed chore(netbird): upstream update available — server 0.77.1 → 0.78.2 #139 and chore(keycloak): upstream update available — keycloak 26.7.2 → 26.7.4, keycloak 26.7.2 → 26.7.4 #140, confirming the fix end-to-end.
• Added a CI job (reenable-scheduled-workflows, push-to-main only, actions: write scoped to that job) that idempotently re-enables the schedule — so after any dormant period, the first push revives the checker. If the repo is dormant forever, nothing runs anyway, so this covers the realistic failure mode.

2. netbird 0.77.1 → 0.78.2, dashboard v2.91.0 → v2.92.0 (#139)

Upstream 0.78.x is almost entirely client-side; the one server-relevant item is a 0.78.1 fix serving networks with peer-based routers from the SQLite network map. Verified upstream's render_combined_yaml and render_dashboard_env are byte-identical between v0.77.1 and v0.78.2 — no config keys, env vars, ports, or protocols used by this chart changed; no manual DB migration. Dashboard v2.92.0 is the release paired with the 0.78.x cycle; env contract unchanged.

3. keycloak 26.7.2 → 26.7.4 (#140)

Pure security patch releases — 26 CVE fixes across 26.7.3/26.7.4, notably CVE-2026-17526 (impersonation-role privilege escalation to realm admin), CVE-2026-16089 (auth-code retargeting), CVE-2026-16093 (signed-JWT policy bypass), CVE-2026-79651 (unauthenticated DoS). No KC_* option, port, health-endpoint, or entrypoint changes.

All three image tags verified to exist (Docker Hub / quay).

Closes #139, #140

How to verify

make test        # helm lint + 376 helm-unittest tests — passing locally
dprint check     # formatting — clean
make e2e         # full suite in kind — all 9 scenarios passed locally (exit 0):
                 #   netbird: sqlite, postgres, mysql, gateway, oidc-keycloak, oidc-zitadel
                 #   keycloak: dev, postgres, replicas

For the checker fix: gh workflow list --all previously showed Upstream Version Check disabled_inactivity; it now shows active, and the manual dispatch that filed #139/#140 is run 35256824993.

🤖 Generated with Claude Code