feat(etcd-operator): bump to v0.5.5 and vendor EtcdDefragPolicy CRDs - #3968

v0.5.5 ships the EtcdDefrag and EtcdDefragPolicy API types (a controller
plus a cron that stamps scheduled defrag runs). Vendor both CRDs into the
etcd-operator-crds package and grant the manager ClusterRole the verbs the
new controllers need: defragpolicies read/patch, defrags full CRUD, the two
new /status subresources, and cluster-scoped event emission.

Backport of #3968 to release-1.6. The automatic cherry-pick could not merge
the etcd-operator-crds Makefile and left the conflict markers in the file;
resolved by taking the five-CRD list the two new CRDs require. The comment
that came with it on main describes an update target that counts annotations
and swaps templates/ atomically — this branch has neither, so it is left out
rather than carried in as a false description. Everything else applied
unchanged.

Signed-off-by: Andrey Kolkov <[email protected]>
Signed-off-by: Andrei Kvapil <[email protected]>

… EtcdDefragPolicy CRDs (#4151)

# Description
Backport of #3968 to `release-1.6`.

A candidate counted as backported as soon as its backport PR had merged,
or as soon as any one of its commits showed up on the branch by subject
or -x reference. That is exactly the shape of the backport bot's
conflict drafts: they stop at the first commit that does not apply and
drop the rest, so merging one reads as a finished backport. A two-commit
PR with only its first commit on the branch and no backport PR linked
reported clean and exited 0.

Judge delivery per commit. Every commit the PR contributed has to be on
the branch -- reachable, named by an -x reference, or present under its
own subject -- skipping merge commits and commits that change nothing,
which the bot drops as well (merge_commits: skip; an empty cherry-pick
applies nothing). Nothing weaker counts: not an -x reference to the
PR's merge commit, which survives a cherry-pick later amended to drop a
commit, and not matching lines, which an unrelated line of the same
text satisfies. Subjects are matched one to one, so two commits both
called "fix tests" need two branch commits of that name, and a branch
commit whose -x reference names another commit is evidence only through
that reference. A wrong "backported" is the one answer a release gate
must not give, while a false alarm costs a look.

Some commits carried is partial, listing the missing ones, whatever the
linked backport PR says. A merged backport PR settles a PR of one commit
alone, as before; for a PR of several with none of them found it proves
only that something merged, and the candidate is unverified. Both fail
the gate.

Backports squashed by hand would then keep a branch red for good, so a
maintainer who has checked one can attest it on the merged backport PR
with a comment that is "backport-audit: complete" and nothing else.
That lifts partial or unverified to confirmed, which passes; the report
names who and links the comment. It counts only as the whole comment,
so it needs no reading of markdown: any other text -- a sentence
mentioning it, a quote, a code block, an explanation -- and it is not an
attestation. It counts only on a PR that merged, only from an author
GitHub associates with the repository as OWNER, MEMBER or COLLABORATOR,
and never from automation, whether its login ends in [bot] or is a
review or dependency bot gh reports without the suffix. A review bot
quoting the marker, a maintainer writing "do not post backport-audit:
complete yet", or a contributor vouching for their own backport
confirms nothing. The audit never infers it.

A git read a verdict depends on that fails, a merge commit missing from
the local repository for instance, now stops the audit with exit 2
instead of being read as a PR with no commits to check.

Unlabelled originals are never checked commit by commit, so their merged
claims read "backport PR merged" rather than "backported here".

On release-1.6 this reports five partials. #3955 and #3968 are real
gaps: a labeler mapping and a comment fix never reached the branch.
#4254 and #4292 were squashed by hand and their remaining changes are on
the branch; #3936's backport cherry-picked the PR's merge commit. Those
three are what an attestation is for, once someone has checked them.

Assisted-by: LLM
Signed-off-by: Myasnikov Daniil <[email protected]>