feat(kafka): gate strimzi 0.46+ upgrade on every kafka being in KRaft #4365

#2352 migrates kafka from zookeeper to KRaft with a chart pre-upgrade hook. Record that an instance migrated is per-release state in tenant namespace, platform migrations and installer never look at it, and run-migrations.sh replays skipped slots by design while a chart hook only exists in the chart version that carries it. So release with #2352 is mandatory stop on upgrade path: cluster that jumps a minor over it lands on the strimzi bump still on zookeeper, and 0.46 dropped zookeeper to KRaft migration entirely, there is no supported path off zookeeper from there.

Right now this is a paragraph in packages/apps/kafka/README.md and nothing enforces it.

Before the bump to strimzi 0.46+ merges, we need a preflight that lists every Kafka CR in the cluster and fails the upgrade while any of them has status.kafkaMetadataState != KRaft. It should fail closed and print namespaces and releases that are still on zookeeper.

Natural place is #3458 (pre-upgrade health gate at hook weight 0, checks drop into preflight/checks/ with no runner change). If that is not merged by then, the strimzi bump PR carries its own gate.