Fix Garage umbrella integration blockers

Summary

• Follow-up to umbrella MR !7826 (closed) that resolves deterministic Garage integration blockers on an isolated branch.
• Sets the stable integrated Helm releaseName to garage while leaving standalone package naming release-derived.
• Preserves explicit false and zero Garage Flux overrides with mergeOverwrite precedence.
• Removes the schema-invalid Helm repository branch field.
• Applies the HTTPS/mTLS ServiceMonitor patch only when Garage sidecar injection is effective.
• Adds an effective-injection pod-template marker to both supported workload kinds so StatefulSet and DaemonSet sidecar or ambient transitions roll Garage automatically.
• Preserves user upstream.environment entries while enforcing the same GARAGE_ADMIN_TOKEN used by the init Job.
• Aligns the umbrella credential guidance with automatic adminToken rollout behavior.
• Temporarily points Garage at the companion 23-integration-blockers-mv package branch for combined validation.

Validation

• helm lint chart: passed for default and Garage HelmRepository source configurations.
• Focused Garage unit suite: 2 suites, 18 tests passed, covering StatefulSet and DaemonSet rollout markers plus custom-environment token merging.
• Exact-head umbrella CI at 8b5184dc: validation and secret scan passed; the Linux runner passed all 64 suites and 373 Helm unit tests.
• Fresh package CI at c0cc9dc parsed this MR's ## Umbrella Branch, cloned 23-integration-blockers-mv, and passed its combined clean-install, Helm, and integration tests against the latest umbrella branch.
• Big Bang/Flux k3d-dev clean install passed with package c0cc9dc: HelmRelease Ready, three Garage pods, six PVCs, authenticated Helm test CRUD, and healthy HTTPS Prometheus targets.
• Seeded 0.9.3-bb.0 upgrade passed: StatefulSet UID and all six PVC/PV identities were preserved, and the authenticated S3 object retained SHA-256 b736641ff1daa50f1ae4042f143931d8f46a9e910c3f49ea730b4c85ee9a79e0.
• Automatic StatefulSet injection transitions passed without a manual restart: enabled → disabled replaced all three pod UIDs, produced sidecar-free pods, and reached healthy HTTP targets; disabled → enabled replaced all three UIDs again, restored sidecars, and reached healthy HTTPS targets.
• Exact-head custom-environment validation passed in k3d-dev: EXTRA_SETTING was preserved, GARAGE_ADMIN_TOKEN remained present, its one-way fingerprint matched the credentials Secret, and the authenticated Helm test passed.
• Exact-head DaemonSet validation passed on all four k3d nodes without a manual restart: enabled → disabled and disabled → enabled each replaced every pod UID, ControllerRevisions recorded both marker states, and all four metrics targets stayed healthy over the matching HTTP/HTTPS transport.
• The cluster was restored to the supported StatefulSet default after DaemonSet testing; all three pods and Helm tests passed, and all six original PVC UIDs remained unchanged.
• Exact-head umbrella CI clean-install retry and upgrade lanes passed all Garage Helm tests and their full integration suites. The pipeline is red only because the docs check cannot resolve the intentionally empty staging tag and the unrelated existing ServerFault URL returns HTTP 403.

Supporting Evidence

Blocker fixed: The integrated Garage HelmRelease upgrades successfully

Blocker fixed: The integrated three-node workload is healthy

Blocker fixed: Authenticated Garage Helm tests pass through the umbrella deployment

Blocker fixed: StatefulSet injection changes create new controller revisions

Blocker fixed: StatefulSet pods converge on the selected injection mode

Blocker fixed: Prometheus transport matches the effective sidecar state

Blocker fixed: Package source and persistent volume identities remain stable

Blocker fixed: DaemonSet pods roll when injection is disabled

Blocker fixed: DaemonSet pods roll again when injection is re-enabled

Blocker fixed: Custom environments retain the enforced Garage admin token

Linked issues

Relates to big-bang/product/maintained/garage#23 (closed)

Follow-up to !7826 (closed)

Companion package MR: big-bang/product/maintained/garage!33 (merged)

Upgrade Notices

Garage receives releaseName: garage before its initial integrated release. Together with the companion package change, the latest published package upgrade retains existing StatefulSet and PVC names instead of forcing a migration.

Remaining work

• Replace the temporary package branch reference with the published 0.9.3-bb.2 tag after the companion package MR is merged.