kubernetes chart: decide whether the aggregation-layer UID flags need a v1.32 path or a v1.33 floor #4373

The tenant Kubernetes chart renders the aggregation-layer UID flags from v1.32, and on v1.32 that means turning on the RemoteRequestHeaderUID feature gate, which is alpha there. A review round on a follow-up branch argued for moving the floor to v1.33, where the gate is beta and on by default, and I think the argument deserves a decision rather than a doc note.

What the v1.33 floor removes: the standalone gate render for v1.32, the merge of RemoteRequestHeaderUID=true into an operator's own --feature-gates entry, the --emulated-version reading that decides where the gate is needed, and roughly a quarter of the OIDC cases in packages/apps/kubernetes/tests/oidc_test.yaml. It also removes the upgrade window described in #4371 by construction, because a v1.32 aggregator already strips a client-supplied X-Remote-Uid, so a v1.32 to v1.33 roll has no replica that forwards it. And the chart stops enabling an alpha gate on every v1.32 tenant with OIDC on, which upstream does not support in production.

What it costs: tenants pinned to v1.32 do not gain UID propagation through the aggregation layer for ServiceAccount tokens and for CustomConfig users with a uid mapping. They do not have it today either, so nothing regresses against the shipped chart. v1.32 is out of upstream patch support and three minors below the chart default.

Not a bug report. #3539 shipped the v1.32 path as reviewed, and the count of tests it carries is the price of supporting a minor that is leaving. If the maintainers want the floor at v1.33, the change is a deletion with a doc update, and the docs/oidc-tenant.md render table shrinks by one row.