tenant chart: nested namespace labels miss ancestor tenant.cozystack.io/* labels beyond direct parent #2810

Summary

When a tenant B is created under another tenant A (which itself is under tenant-root), the namespace tenant-B receives tenant.cozystack.io/tenant-A and tenant.cozystack.io/tenant-B labels, but not tenant.cozystack.io/tenant-root. This breaks the chain that egress CiliumClusterwideNetworkPolicy objects rely on and prevents the root ingress controller from proxying traffic into nested tenants.

Impact

• addons.ingressNginx.hosts on a nested Kubernetes (k8s-tenant) CR creates an Ingress on the root ingress class, but the root ingress controller cannot reach the proxy Service in the nested tenant namespace because the tenant-root-egress CiliumClusterwideNetworkPolicy restricts egress to namespaces labeled tenant.cozystack.io/tenant-root.
• External traffic to the host gets a TCP accept on the root ingress IP, the HTTP request is sent successfully, but the upstream connect times out. Root ingress controller logs:

  upstream timed out (110: Operation timed out) while connecting to upstream,
  upstream: "http://10.244.x.y:30000/", host: "<configured-host>"
  

Repro

1. Create apps.cozystack.io/v1alpha1/Tenant A in tenant-root namespace. Resulting tenant-A namespace correctly has both tenant.cozystack.io/tenant-root and tenant.cozystack.io/tenant-A labels.
2. Create apps.cozystack.io/v1alpha1/Tenant B in tenant-A namespace. Resulting tenant-B namespace has only tenant.cozystack.io/tenant-A and tenant.cozystack.io/tenant-B. Missing: tenant.cozystack.io/tenant-root.
3. Create apps.cozystack.io/v1alpha1/Kubernetes in tenant-B namespace with addons.ingressNginx.enabled: true and addons.ingressNginx.hosts: [foo.example.com].
4. Point DNS foo.example.com to the root ingress public IP.
5. curl http://foo.example.com/ from the internet — TCP connects, HTTP request is sent, no response.

Root cause

packages/apps/tenant/templates/namespace.yaml derives ancestor labels by splitting the parent namespace name on -:

```yaml
{{- $parts := splitList "-" .Release.Namespace }}
{{- range $i, $v := $parts }}
{{- if ne $i 0 }}
tenant.cozystack.io/{{ join "-" (slice $parts 0 (add $i 1)) }}: ""
{{- end }}
{{- end }}
```

This assumes tenant names encode the full hierarchy chain in their name (e.g. tenant-root-a-b), but the actual naming convention uses short names (tenant-a, tenant-b). So for Release.Namespace = \"tenant-a\", the loop yields only tenant.cozystack.io/tenant-a, missing tenant.cozystack.io/tenant-root (and any deeper ancestor in a 3+ level hierarchy).

Expected

Each tenant namespace should carry tenant.cozystack.io/<ancestor> labels for all ancestors up to tenant-root, so the egress/ingress policies derived from those labels grant cross-tenant traversal as the platform model intends.

Suggested fix

Read the parent namespace's existing tenant.cozystack.io/* labels via `lookup` and propagate them all, plus add the namespace's own label. Roughly:

```yaml
{{- $parentNS := lookup "v1" "Namespace" "" .Release.Namespace }}
{{- range $k, $_ := (default dict $parentNS.metadata.labels) }}
{{- if hasPrefix "tenant.cozystack.io/" $k }}
{{ $k }}: ""
{{- end }}
{{- end }}
tenant.cozystack.io/{{ $tenantName }}: ""
```

Workaround

Manually label the affected nested namespace until the chart is fixed:

```bash
kubectl label namespace tenant-b tenant.cozystack.io/tenant-root=""
```