fix(seaweedfs): wait for ingress-nginx-system before creating Ingress - #2406

Blocker: this dependency breaks nested tenants that inherit ingress from a parent.

$ingress is computed at line 96 from .Values._namespace.ingress, which is populated by the tenant chart at packages/apps/tenant/templates/namespace.yaml:27-30:

{{- $ingress := $parentNamespace.ingress | default "" }}
{{- if .Values.ingress }}
{{- $ingress = $tenantName }}
{{- end }}

So _namespace.ingress is either this tenant's own namespace (when .Values.ingress: true) or the parent's namespace inherited through $parentNamespace.ingress. This is the documented nested-tenant model at packages/apps/tenant/README.md (the tenant-u1 / tenant-u2 example — u2 borrows u1's ingress).

For such a subtenant (ingress: false, seaweedfs: true, parent has ingress: true), $ingress is the parent namespace name (truthy), but ingress-nginx-system only gets rendered by packages/extra/ingress/templates/nginx-ingress.yaml — and the outer ingress HR that triggers it exists only when .Values.ingress: true at the tenant level (see packages/apps/tenant/templates/ingress.yaml:1). So in the subtenant's own namespace there is no ingress-nginx-system HR.

Flux dependsOn without a namespace: defaults to the HelmRelease's own namespace (meta.NamespacedObjectReference godoc; helm-controller checkDependencies). Missing dependencies don't time out — helm-controller requeues at DependencyRequeueInterval with DependencyNotReadyReason indefinitely. Combined with install.remediation.retries: -1 on this HR, the subtenant's seaweedfs-system will never install.

Current E2E at hack/e2e-install-cozystack.bats only covers tenant-root (self-ingress), so the regression will not show up in CI.

Suggested fix — gate on "this tenant owns its own ingress" so the dependency only appears when the target HR is actually local:

{{- if eq $ingress .Release.Namespace }}
# Ensure the ingress-nginx admission webhook is ready before creating Ingress resources.
dependsOn:
- name: ingress-nginx-system
  namespace: {{ .Release.Namespace }}
{{- end }}

This preserves the tenant-root bootstrap fix (where $ingress == "tenant-root" == .Release.Namespace) and skips the dependency for inherited cases (where the parent's ingress controller is already running anyway, so no race).

Two non-blocking notes while you're here:

1. Every other dependsOn in the tree specifies namespace: explicitly (e.g., packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml:59). Worth matching that convention — it's what made the implicit-namespace behavior non-obvious in the first place.

2. packages/extra/seaweedfs/templates/ingress.yaml creates a standalone seaweedfs-filer-external Ingress under .Values.filer.grpcHost via the outer HR, so it's not protected by this inner dependsOn. Probably out of scope for this PR (the E2E failure is specifically the inner HR), but a candidate for a follow-up.

Addressed in 7aadb4a: gated the dependsOn on eq $ingress .Release.Namespace per your suggestion, and added explicit namespace: to match the rest of the tree.

Verified by rendering the template in three modes:

• own ingress (tenant-root / _namespace.ingress = tenant-root) → dependsOn block emitted with namespace: tenant-root
• inherited from parent (tenant-u2 / _namespace.ingress = tenant-parent) → dependsOn block skipped
• no ingress (empty string) → dependsOn block skipped

Left the standalone seaweedfs-filer-external Ingress in templates/ingress.yaml untouched per your "out of scope" note — happy to do that as a follow-up.

The PR title and commits do not follow the Conventional Commits format required by the repository style guide. Please update the PR title to follow the type(scope): description format (e.g., fix(seaweedfs): wait for ingress-nginx-system before creating Ingress). Also, ensure all commits have the Signed-off-by: trailer.