Define opt-in Cortex Tenant ingress to Mimir

General MR

Summary

• Keep the Cortex Tenant to Mimir distributor TCP 8080 ingress rule defined in package values, disabled by default.
• Test the generated distributor and source selectors when the rule is explicitly enabled.
• Merge current main, retaining the mimir-distributed 6.2.1 upgrade and its documentation.
• Bump the wrapper chart to 6.2.1-bb.1, update the changelog, and regenerate the README.

Relevant logs/screenshots

• helm lint ./chart passed.
• helm unittest chart/ -f "unittests/**/*_test.yaml" passed.
• Helm render confirms the Cortex Tenant policy is absent by default and present when enabled.
• The Cortex Tenant package CI overlay explicitly enables the distributor rule for end-to-end delivery.

Umbrella Branch

alloy-cortex-tenant-prewiring

Linked Issue

big-bang/bigbang#3464 (closed)

Upgrade Notices

For a standalone Mimir deployment receiving writes from Cortex Tenant, enable networkPolicies.ingress.to.mimir-distributor:8080.from.k8s.cortex-tenant/cortex-tenant. The Big Bang umbrella enables this connection when Alloy is configured to write through Cortex Tenant.