kubernetes chart: a patch-level --emulated-version renders the v1.32 gate and then stops the tenant apiserver from starting #4396

A patch-level --emulated-version in a tenant's controlPlane.apiServer.extraArgs renders without complaint and then stops the tenant kube-apiserver from starting.

The chart reads the value for its minor, so --emulated-version=1.32.4 on a v1.34 cluster is read as 1.32 and the RemoteRequestHeaderUID gate is rendered alongside the UID header flag, which is the correct rendering for an effective 1.32. The apiserver disagrees earlier than that: toVersionMap refuses a patch-level component version outright, so the process exits before any of it matters and the operator gets a crash loop rather than a message about the value they wrote.

Nothing here is new. The behaviour is the same on the current pin and on the newer Kamaji, and the OIDC chart change that documents it did not introduce it. What changed is that docs/oidc-tenant.md now names the value as one the chart reads past and the apiserver still refuses, so the trap is written down rather than guarded.

A render-time check would close it: the chart already trims and inspects that value, and requiring it to match ^[0-9]+\.[0-9]+$ before reading a minor out of it turns a crash-looping control plane into a render error naming the entry. That is a few lines in the same block that reads the flag, and it belongs to whoever next touches that block rather than to the bump PR that found it.