fix(helm): recreate the rustfs bucket-init Job, its image from gsoci

[teemow]

Problem

The rustfs-bucket-init Job is a plain release resource, and a Job's pod template is immutable. Any change of its image fails the upgrade of every installation with spec.template: … field is immutable until someone deletes the completed Job by hand. So the chart kept Docker Hub's short name amazon/aws-cli, the one image the platform can't pull from gsoci yet (giantswarm/agent-platform#580).

Change

• The Job is a Helm hook: post-install,post-upgrade, delete policy before-hook-creation,hook-succeeded. It's recreated on every install and upgrade under the same name, which network policies select the pod by (job-name). On an upgrade from a release where the Job is a release resource, Helm deletes the old Job (it's gone from the manifest) and the post-upgrade hook creates the new one. A completed Job is deleted: left behind, it would block a rollback to such a release with an unowned object of the same name.
• hack/install-microvm-deps.sh and hack/microvm-assets/stage-to-rustfs.sh wait for the Job only while it exists: a Helm install ran it to completion, and a Kustomize install leaves it to be waited for. stage-to-rustfs.sh runs the same gsoci image.
• images.awsCli is the gsoci copy gsoci.azurecr.io/giantswarm/aws-cli:2.17.0, same digest as upstream's pin.
• tests/rustfs_test.yaml holds the hook; tests/images_test.yaml holds the gsoci default. FORK.md gets a carried-patch row; manifests/ate-install/rustfs.yaml is re-rendered.

Checks

helm unittest charts/substrate: 53/53 pass.

Proof

An agentlab upgrade from 1.1.1 to this branch's dev build: the old Job goes, the hook Job runs from gsoci and completes, and the Substrate HelmRelease is Ready. Result to follow in a comment.

[teemow]

From Timo's agent: lab proof on a local kind lab running agent-platform 4.79.0 (Substrate 1.1.1 through the meta chart's Flux HelmRelease). The released 1.1.1 chart with exactly this PR's rustfs.yaml hunk and images.awsCli default was packaged as 1.1.2-proof.85 and pushed to the lab registry. The OCIRepository pointed at it, and images.awsCli was the gsoci copy (as the meta chart will forward it).

• Upgrade 1.1.1 → proof, helm-controller, 7 s, Ready. Before: rustfs-bucket-init, a release resource (meta.helm.sh/release-name: substrate), Complete on amazon/aws-cli:2.17.0@sha256:6435…. After: the old Job deleted, the hook Job created, pulled gsoci.azurecr.io/giantswarm/aws-cli:2.17.0@sha256:6435… and completed in about 5 s, then deleted (hook-succeeded). helm get hooks names it with post-install,post-upgrade / before-hook-creation,hook-succeeded.
• Back to 1.1.1 (the OCIRepository on gsoci's range again, the Docker Hub value), helm-controller, Ready. The plain Job was recreated as a release resource and completed, with no conflict: the case a Job left behind by the hook would have blocked.