bundles.disabledPackages can break the dependency closure with no render-time error #3389

Symptom

bundles.disabledPackages can remove a package that other emitted packages hard-depend on. The chart renders successfully, and the dependents then sit in DependenciesNotReady indefinitely with nothing in the render output naming the cause.

Mechanism

cozystack.platform.package in packages/core/platform/templates/_helpers.tpl skips emission for any name listed in bundles.disabledPackages, but nothing cross-checks that against the dependsOn edges declared by the PackageSource definitions in packages/core/platform/sources/.

Reproduction against values-isp-hosted.yaml with bundles.disabledPackages: [cozystack.cozystack-engine] — renders cleanly, emits 52 Packages, and leaves cozystack.cozystack-engine unresolved for 27 of them (every *-application in the catalog, plus cozystack-basics, flux-plunger, flux-shard-operator and tenant-application).

Disabling cozystack.bucket-application reproduces the same shape via cozystack.backupstrategy-controller, which hard-depends on it.

This is the same failure class as #3376, reached through a different door. The guards added alongside that fix cover the bundle-level flags (bundles.{paas,naas,iaas}.enabled now require bundles.system.enabled) but deliberately do not cover this path.

Suggested fix

Validate the dependency closure of the emitted Package set at render time and fail with the list of unsatisfied edges, rather than guarding one misconfiguration shape at a time.

The PackageSource YAML is already available to the chart — templates/sources.yaml reads it via .Files.Glob "sources/*.yaml" — so the dependsOn edges can be parsed with fromYaml. The obstacle is the emitted set: the bundles are plain template files, so the names cannot be accumulated across them. Converting the four bundle bodies into named templates (define) would make a single closure check expressible, and would subsume both the existing bundle-flag guards and this one.

A cheaper interim step is a check limited to disabledPackages: for each disabled name, fail if any still-emitted package declares it in dependsOn.

Notes

Found while reviewing the fix for #3376.