fix(tests): keep two unit tests green after the release image restamp (#5180)

## What this PR does

Same change as #5179, on `main`. Both tests pass here today, because
`main` still carries the pre-release image pins; they fail on every
release line as soon as the first rc is cut, since the `Prepare release`
commit rewrites `packages/*/values.yaml` and two unit tests read exactly
the fields it rewrites. On `release-1.7` this has kept `Unit &
controller tests` red on every PR since v1.7.0-rc.3
([job](https://github.com/cozystack/cozystack/actions/runs/41162009892/job/124421449910)
on #5172), and `release-1.8` would repeat it.

| test | reads | before the release build | after (release-1.7 today) |
|---|---|---|---|
| `hack/cni-plugins-staging-contract.bats` "the kube-ovn release the CNI
plugin pin was checked against is the one vendored" |
`.global.images.kubeovn.tag` in `packages/system/kubeovn/values.yaml` |
`v1.15.26@sha256:…` | `v1.7.0@sha256:…` |
| `packages/system/monitoring/tests/vtraces_collector_test.yaml` "pins
the collector image through the cozy-lib.image helper" |
`tracingCollector.image` |
`docker.io/otel/opentelemetry-collector-contrib:0.136.0@sha256:…` |
`ghcr.io/cozystack/cozystack/otelcol-tracing:v0.136.0-cozystack.0@sha256:…`
|

Changes:

- The bats test takes the vendored kube-ovn release from `appVersion` in
`packages/system/kubeovn/charts/kube-ovn/Chart.yaml`. That is the value
`packages/system/kubeovn/Makefile` builds the image from, and a release
build leaves it alone. The hint printed on a mismatch names the new
file.
- The helm unittest case no longer names the image at all. It sets
`_cluster.images-registry` and asserts that the registry lands in front
of the rendered image and that the image stays digest-pinned (the
`grafana_upstream_image_plugins_test.yaml` pattern). Removing the
`cozy-lib.image` call from the template makes it fail; the old regex did
not.

Same single commit as #5179; the only difference is the unrelated `DOC=`
line next to the edit, kept as `main` has it.

Verified locally on this branch: `bats
hack/cni-plugins-staging-contract.bats` 10/10, `helm unittest
packages/system/monitoring -f tests/vtraces_collector_test.yaml` 28/28.

Refs #5178 (the release-1.7 report), #5179, #5172.

### Downstream repositories

- [x] No downstream repository is affected by this change

### Release note

```release-note
NONE
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Tests**
* Version validation now compares the checked version with the chart’s
application version and reports missing or mismatched versions with the
chart path.
* Monitoring image checks now verify use of the configured mirror
registry and require a 64-character lowercase SHA-256 digest, without
requiring a specific image name.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

hack/cni-plugins-staging-contract.bats

@@ -22,7 +22,10 @@ extract_has() {
 }
 
 DOCKERFILE="$PWD/packages/system/multus/images/multus-cni/Dockerfile"
-KUBEOVN_VALUES="$PWD/packages/system/kubeovn/values.yaml"
+# The chart's appVersion, not the values.yaml image tag: a release build
+# restamps that tag to the Cozystack version (v1.7.0), the chart keeps the
+# kube-ovn release it vendors.
+KUBEOVN_CHART="$PWD/packages/system/kubeovn/charts/kube-ovn/Chart.yaml"
 DOC="$PWD/packages/system/multus/README.md"
 PLATFORM_VALUES="$PWD/packages/core/platform/values.yaml"
 TEMPLATE="$PWD/packages/system/multus/templates/multus-daemonset-thick.yml"
@@ -347,13 +350,12 @@ PATCHFILE="$PWD/packages/system/multus/patches/customize-deployment.patch"
   checked=$(sed -n 's|^# kube-ovn-cni-plugins-checked-against: *\([^ ]*\) *$|\1|p' "$DOCKERFILE")
   [ -n "$checked" ]
 
-  vendored=$(yq -r '.global.images.kubeovn.tag' "$KUBEOVN_VALUES" | sed 's|@.*||')
-  [ -n "$vendored" ]
-  [ "$vendored" != "null" ]
+  vendored=$(awk '$1 == "appVersion:" {gsub(/"/, "", $2); print "v" $2}' "$KUBEOVN_CHART")
+  [ "$vendored" != "v" ]
 
   if [ "$checked" != "$vendored" ]; then
     echo "the multus CNI plugin pin was checked against kube-ovn $checked," >&2
-    echo "but packages/system/kubeovn/values.yaml now vendors $vendored." >&2
+    echo "but packages/system/kubeovn/charts/kube-ovn/Chart.yaml now vendors $vendored." >&2
     echo >&2
     echo "Read CNI_PLUGINS_VERSION in kube-ovn $vendored's base image" >&2
     echo "(dist/images/Dockerfile.base). If it still matches the" >&2

packages/system/monitoring/tests/vtraces_collector_test.yaml

@@ -473,11 +473,18 @@ tests:
           path: spec.template.spec.containers[0].securityContext.capabilities.drop
           content: ALL
 
+  # The image name is not asserted: a release build swaps the upstream
+  # collector for the first-party otelcol-tracing one and restamps the tag.
+  # What must hold is that the value goes through cozy-lib.image (the cluster
+  # images-registry lands in front of it) and stays digest-pinned.
   - it: pins the collector image through the cozy-lib.image helper
+    set:
+      _cluster:
+        images-registry: mirror.example.com
     documentSelector:
       path: kind
       value: Deployment
     asserts:
       - matchRegex:
           path: spec.template.spec.containers[0].image
-          pattern: "opentelemetry-collector-contrib:.*@sha256:"
+          pattern: '^mirror\.example\.com/.+@sha256:[0-9a-f]{64}$'