fix(backups): compare the credentials endpoint only for the forced bucket's Secret

The gate forces bucket-<bucketName>-system, which renders the
credentials Secret of that bucket's system user and nothing else. The
COSI Secret name was derived from systemSecretName instead, so a value
naming another bucket's Secret made a lagging endpoint there force the
platform bucket release every throttle window without ever refreshing
the Secret that was compared.

Assisted-by: LLM
Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>

packages/system/backupstrategy-controller/templates/deployment.yaml

@@ -91,10 +91,13 @@ spec:
         # (packages/system/bucket/templates/user-credentials.yaml appends
         # "-credentials" to its name). The COSI sidecar writes it once per
         # BucketAccess, so the gate compares the two endpoints and forces the
-        # release when the credentials Secret lags behind.
-        {{- if hasSuffix "-credentials" .Values.backupStorage.systemSecretName }}
+        # release when the credentials Secret lags behind. Only the system
+        # user's Secret of this very bucket is rendered by that release; any
+        # other systemSecretName would be forced without ever changing.
+        {{- $cosiSecretName := printf "bucket-%s-system" .Values.backupStorage.bucketName }}
+        {{- if eq .Values.backupStorage.systemSecretName (printf "%s-credentials" $cosiSecretName) }}
         - name: BACKUP_CREDENTIALS_COSI_SECRET_NAME
-          value: {{ trimSuffix "-credentials" .Values.backupStorage.systemSecretName | quote }}
+          value: {{ $cosiSecretName | quote }}
         {{- end }}
         {{- end }}
         {{- if .Values.velero.bslEnabled }}

packages/system/backupstrategy-controller/tests/default_objects_gate_test.yaml

@@ -141,6 +141,21 @@ tests:
           content:
             name: BACKUP_CREDENTIALS_COSI_SECRET_NAME
 
+  # The forced release renders only <release>-credentials for its own system
+  # user. A systemSecretName naming another bucket's Secret is not refreshed by
+  # forcing bucket-<bucketName>-system, so comparing it would force that
+  # release every MinForceInterval and change nothing.
+  - it: "systemSecretName of another bucket: no COSI Secret to compare against"
+    template: templates/deployment.yaml
+    set:
+      backupStorage.systemSecretName: bucket-other-system-credentials
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          any: true
+          content:
+            name: BACKUP_CREDENTIALS_COSI_SECRET_NAME
+
   - it: "velero.bslEnabled=false: the BSL is not rendered, so the gate must not look for it"
     template: templates/deployment.yaml
     set: