fix(clickhouse): guard migration when keeper CRD absent and quote hook scalars

Address CodeRabbit review on #3072:

- Migration 45 now skips the backfill when the
  clickhousekeeperinstallations CRD is not installed. The migration runs
  platform-wide via targetVersion, so on clusters that never deployed
  ClickHouse the kubectl get would otherwise fail under set -euo pipefail
  and abort the whole upgrade.
- Quote the templated name/label/serviceAccountName scalars in the cleanup
  hook so the source parses under YAMLlint; rendered output is unchanged.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Алексей Артамонов <alexeyartamonov1987@gmail.com>

packages/apps/clickhouse/templates/hooks/cleanup-pvc.yaml

@@ -2,9 +2,9 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
   labels:
-    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "10"
@@ -13,10 +13,10 @@ spec:
   template:
     metadata:
       labels:
-        app.kubernetes.io/instance: {{ .Release.Name }}
+        app.kubernetes.io/instance: "{{ .Release.Name }}"
         policy.cozystack.io/allow-to-apiserver: "true"
     spec:
-      serviceAccountName: {{ .Release.Name }}-cleanup
+      serviceAccountName: "{{ .Release.Name }}-cleanup"
       restartPolicy: Never
       securityContext:
         runAsNonRoot: true
@@ -63,9 +63,9 @@ spec:
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
   labels:
-    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "0"
@@ -74,9 +74,9 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
   labels:
-    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "5"
@@ -89,9 +89,9 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
   labels:
-    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/instance: "{{ .Release.Name }}"
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "5"
@@ -99,7 +99,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: {{ .Release.Name }}-cleanup
+  name: "{{ .Release.Name }}-cleanup"
 subjects:
   - kind: ServiceAccount
-    name: {{ .Release.Name }}-cleanup
+    name: "{{ .Release.Name }}-cleanup"