Enable leader election for Cozystack - #23

…gate

Conformance review against the design proposals surfaced that a short-name tap
ignored the index entry's recorded version: resolveTapTarget returned the bare
ociRef, so 'cozypkg tap <name>' pulled :latest while the CI gate had validated
and cosign-verified <ociRef>:<version>. The gate signed one tag and the cluster
pulled another, breaking both the versioning model (#18) and the signature
chain (#23). Resolve the short name to <ociRef>:<version> when a version is
recorded.

Also harden the publication gate: run 'cozypkg validate --helm-lint' (with helm
installed in the workflow) so charts are linted as the design specifies, and add
a CODEOWNERS so every index entry requires maintainer review.

Signed-off-by: IvanHunters <[email protected]>

Add a search box that filters connected repositories and their packages by
name, kind, description, category, or tag, and a trust notice stating that
connecting a repository runs its charts in the management cluster and that
signatures are verified by the index at publication time, not at connect time.
Both close gaps the design-conformance review found against #18/#23.

Signed-off-by: IvanHunters <[email protected]>

…ivileged

'cozypkg add' now lists the privileged components of the selected variant and
requires an explicit confirmation (defaulting to No) before installing them,
unless --allow-privileged is passed. This is the install-time privileged
confirmation #23 specifies; the badge and validate warning already existed.

Signed-off-by: IvanHunters <[email protected]>

…gate

Conformance review against the design proposals surfaced that a short-name tap
ignored the index entry's recorded version: resolveTapTarget returned the bare
ociRef, so 'cozypkg tap <name>' pulled :latest while the CI gate had validated
and cosign-verified <ociRef>:<version>. The gate signed one tag and the cluster
pulled another, breaking both the versioning model (#18) and the signature
chain (#23). Resolve the short name to <ociRef>:<version> when a version is
recorded.

Also harden the publication gate: run 'cozypkg validate --helm-lint' (with helm
installed in the workflow) so charts are linted as the design specifies, and add
a CODEOWNERS so every index entry requires maintainer review.

Signed-off-by: IvanHunters <[email protected]>

Add a search box that filters connected repositories and their packages by
name, kind, description, category, or tag, and a trust notice stating that
connecting a repository runs its charts in the management cluster and that
signatures are verified by the index at publication time, not at connect time.
Both close gaps the design-conformance review found against #18/#23.

Signed-off-by: IvanHunters <[email protected]>

…ivileged

'cozypkg add' now lists the privileged components of the selected variant and
requires an explicit confirmation (defaulting to No) before installing them,
unless --allow-privileged is passed. This is the install-time privileged
confirmation #23 specifies; the badge and validate warning already existed.

Signed-off-by: IvanHunters <[email protected]>