feat(c5c3): expose freeform service configuration on the ControlPlane

[berendt]

Summary

Expose freeform service configuration on the ControlPlane. Today the ControlPlane surfaces only a curated subset of each service's settings; the freeform extraConfig field lives only on the child CRs, where a direct edit does not stick once the ControlPlane owns the field. This branch adds a global INI block spec.globalExtraConfig and per-service blocks spec.services.{keystone,glance,horizon}.extraConfig, merges the INI blocks key by key (per-service wins), projects the result onto the children, and runs the sibling issues' option-catalog and owned-key checks against the merged result at ControlPlane admission — every rejection and warning naming the block that carries the offending key.

Closes #704

Change set (in commit order)

1. 6ed3a326 refactor(horizon): export the Python setting-name pattern — Renames the package-level pythonSettingName regexp to PythonSettingName (and updates its two uses) so the ControlPlane webhook validates services.horizon.extraConfig setting names with the exact identifier pattern the Horizon child webhook enforces, instead of copying the regexp and risking drift.

2. 135e92c5 feat(c5c3): add extraConfig API fields and merge helper — Adds the four spec fields: GlobalExtraConfig and per-service ExtraConfig on Keystone/Glance (map[string]map[string]string) and Horizon (map[string]apiextensionsv1.JSON). Adds a CEL rule forbidding services.keystone.extraConfig in External mode. Adds the shared MergedExtraConfig(global, service) helper (in the api package so reconciler and webhook can never validate one merge and project another), normalized to nil on an empty merge, plus the nil-safe ServiceHorizonSpec.DerivedPublicEndpoint. Regenerates deepcopy + CRD artifacts and promotes k8s.io/apiextensions-apiserver to a direct require.

3. 22dcab5c feat(c5c3): project merged extraConfig onto service children — Projects the freeform blocks onto the three children, each assigned unconditionally so clearing a ControlPlane block reverts the child rather than pinning the last value. Keystone and Glance get the MergedExtraConfig result; Horizon gets its flat Django block deep-copied verbatim (the global INI block never applies to it) so the child never aliases cp.Spec. Projection and the admission-time dashboard-origin check both call the api package's DerivedPublicEndpoint so the URL is derived identically.

4. 47ebe973 feat(c5c3): validate ControlPlane extraConfig at admission — Wires two validation families into the ControlPlane webhook. Family A (shape and ownership, un-gated) rejects malformed section/key/Horizon-setting names, forbids overrides of operator-owned keys (Glance keystone_authtoken password, Keystone Horizon-derived trusted_dashboard, Horizon SECRET_KEY/websso/multi-domain), and warns on honored-but-owned overrides — attributing every finding to the concrete global or per-service block. Family B validates the merged INI of each declared INI service against the release option catalog, gated on update by an input-change check so an unrelated edit (e.g. a replica bump) never rejects a CR whose extraConfig went stale-invalid; it fails open with a single warning when no catalog resolves. The webhook also mirrors the External-mode CEL rule.

5. 492ea721 test(e2e): add ControlPlane extraConfig invalid-cr fixtures — Adds four generated invalid-CR fixtures pinning the admission rejections against a real API server: unknown option in globalExtraConfig (keystone catalog, with provenance path), unknown option in services.glance.extraConfig (glance catalog), services.keystone.extraConfig in External mode (type-level CEL), and SECRET_KEY in services.horizon.extraConfig (ownership check). The canonical scaffold gains a globalExtraConfig placeholder that renders empty for every existing fixture, so all prior outputs stay byte-identical.

6. 2b7e2048 docs: document ControlPlane freeform service configuration — Adds a Free-form service configuration section to the advanced-configuration guide (merge semantics, Horizon special case, provenance messages, External-mode posture, admission behavior, revert-on-clear, and the operator-build catalog-skew limitation with its ProjectionRejected condition names) and refreshes the stale "not exposed" claims. Extends the ControlPlane CRD reference with the globalExtraConfig and per-service extraConfig rows, the External-mode forbid rule, and an ExtraConfig admission-checks subsection.

Divergence from the issue

None material. The implementation follows the plan's binding decisions — key-by-key merge, Horizon as a per-service block only, and the ControlPlane webhook importing the service api packages directly (with the L1-import DECISION comment amended accordingly). As the plan anticipated, the shared dashboard-URL derivation horizonPublicEndpoint was moved out of internal/controller/identity_backends.go into the api package as ServiceHorizonSpec.DerivedPublicEndpoint, which is why that file shows a net deletion.

---

Implemented by planwerk-agent c4682b7 with Claude:claude-opus-4-8