opensearch: the admin credentials Secret of one release is the credentials Secret of another #4065

Describe the bug
packages/apps/opensearch/templates/security.yaml renders <release>-admin-credentials (line 13) and the tenant-facing <release>-credentials (line 105). A release named foo and a release named foo-admin in the same namespace both produce foo-admin-credentials: the admin Secret of the first is the user-facing Secret of the second. Both carry the admin password, security.yaml:2 re-reads the name through lookup, and the dashboard resource map grants <release>-credentials to the tenant by name, so the tenant of foo-admin reads the admin password of foo.

Same shape as the CA Secret collision #2682 and #2680 fix with a dotted suffix. Renaming -credentials breaks every existing client, so it is not folded into those PRs.

Environment

• Cozystack main, 2026-09-04

To Reproduce

1. helm template foo packages/apps/opensearch and helm template foo-admin packages/apps/opensearch
2. foo-admin-credentials is in both outputs

Expected behaviour
No Secret name of one release can be produced by another release of the same chart.

Actual behaviour
Both releases write the same object and the resource map hands it to the wrong tenant.

Additional context
A dotted suffix on the admin Secret (<release>.admin-credentials) is not tenant-facing and so not breaking. The alternative is a render-time refusal of release names ending in -admin.

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs