fix(migration): protect keycloak HelmReleases during v1.0 upgrade

In v0.41.x keycloak HelmReleases were created directly by the platform
chart (helmreleases.yaml). In v1.0 this template was removed and keycloak
is managed via Package API. Without protection, Helm deletes these
HelmReleases during upgrade, triggering FluxCD to run helm uninstall and
destroying all keycloak data (credentials, realm config, PostgreSQL DB).

Add migration 34 that annotates keycloak, keycloak-operator, and
keycloak-configure HelmReleases with helm.sh/resource-policy=keep before
the platform chart upgrade. This allows the Package operator to adopt
existing HelmReleases and FluxCD to perform helm upgrade instead of
a fresh install, preserving all data.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

packages/core/platform/images/migrations/migrations/34

@@ -0,0 +1,34 @@
+#!/bin/sh
+# Migration 34 --> 35
+# Protect keycloak HelmReleases from deletion during platform chart upgrade.
+#
+# In v0.41.x keycloak, keycloak-operator, and keycloak-configure HelmReleases
+# were created directly by the platform chart (helmreleases.yaml). In v1.0
+# this template was removed and keycloak is managed via Package API instead.
+# Without the keep annotation, Helm deletes these HelmReleases during upgrade,
+# which triggers FluxCD to run helm uninstall, destroying all keycloak data
+# (credentials, realm configuration, PostgreSQL database).
+#
+# The keep annotation ensures the HelmReleases survive the chart upgrade so
+# the Package operator can adopt them and FluxCD performs a helm upgrade
+# instead of a fresh install.
+
+set -euo pipefail
+
+echo "=== Protecting keycloak HelmReleases from deletion ==="
+
+for hr_name in keycloak keycloak-operator keycloak-configure; do
+  if kubectl get helmrelease "$hr_name" -n cozy-keycloak --no-headers 2>/dev/null | grep -q .; then
+    echo "  [ANNOTATE] hr/${hr_name} in cozy-keycloak"
+    kubectl annotate helmrelease "$hr_name" -n cozy-keycloak \
+      helm.sh/resource-policy=keep --overwrite
+  else
+    echo "  [SKIP] hr/${hr_name} not found in cozy-keycloak"
+  fi
+done
+
+echo "=== Done ==="
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=35 --dry-run=client -o yaml | kubectl apply -f-

packages/core/platform/values.yaml

@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0@sha256:68dabdebc38ac439228ae07031cc70e0fa184a24bd4e5b3b22c17466b2a55201
-  targetVersion: 34
+  targetVersion: 35
 # Bundle deployment configuration
 bundles:
   system: