fix(apps/kubernetes): normalize Job also clears stale extraArgs and extraVolumeMounts

Follow-up to the KCP cleanup extension: Kamaji's SSA field manager
takes ownership of `spec.apiServer.extraArgs` and
`spec.apiServer.extraVolumeMounts` too, not just
`spec.deployment.extraVolumes`. The previous normalize patch only
replaced extraVolumes; the two remaining fields still carried the
`--authentication-config=` flag and the corresponding mount even
after mode was toggled to None.

Extend the merge patch to REPLACE all three fields at once, sourced
from Helm values so user-supplied entries in
`controlPlane.apiServer.extra{Args,VolumeMounts,Volumes}` remain
intact — only the chart-owned OIDC-only entries drop off.

Verified on dev3: with the extended patch, mode=System → mode=None
leaves the tenant KCP with `extraArgs: []`,
`extraVolumeMounts: []`, and `deployment.extraVolumes` back to just
`talos-ca`, `talos-tls-cert` (or those + operator-supplied extras).

Signed-off-by: Ivan Okhotnikov <ivan.okhotnikov@aenix.io>

packages/apps/kubernetes/templates/oidc-rbac-job.yaml

@@ -180,10 +180,18 @@ spec:
                 #    manager takes ownership of spec.deployment.extraVolumes on
                 #    write-back to the TenantControlPlane. Verified end-to-end
                 #    against a real Kamaji controller.
-                echo "  patching KamajiControlPlane $RELEASE — remove authentication-config volume"
+                echo "  patching KamajiControlPlane $RELEASE — remove OIDC-only entries from extraArgs, extraVolumeMounts, deployment.extraVolumes"
+                # Patch payload is rendered at helm template time from the same
+                # source of truth cluster.yaml uses: user-supplied extras stay
+                # intact, only the chart-owned OIDC-only entries (that Kamaji's
+                # SSA field-owner refuses to release) are stripped.
                 kubectl --namespace "$RELEASE_NAMESPACE" patch kamajicontrolplane "$RELEASE" \
                   --type=merge \
-                  --patch '{"spec":{"deployment":{"extraVolumes":[{"name":"talos-ca","secret":{"secretName":"'"$RELEASE"'-talos-ca"}},{"name":"talos-tls-cert","secret":{"secretName":"'"$RELEASE"'-talos-tls-cert"}}]}}}'
+                  --patch {{ printf "{\"spec\":{\"apiServer\":{\"extraArgs\":%s,\"extraVolumeMounts\":%s},\"deployment\":{\"extraVolumes\":%s}}}"
+                      (default (list) .Values.controlPlane.apiServer.extraArgs | toJson)
+                      (default (list) .Values.controlPlane.apiServer.extraVolumeMounts | toJson)
+                      (concat (list (dict "name" "talos-ca" "secret" (dict "secretName" (printf "%s-talos-ca" .Release.Name))) (dict "name" "talos-tls-cert" "secret" (dict "secretName" (printf "%s-talos-tls-cert" .Release.Name)))) (default (list) .Values.controlPlane.apiServer.extraVolumes) | toJson)
+                      | quote }}
 
                 # 2. Chart-owned OIDC Secrets — Helm's SSA-based delete-on-absence
                 #    also fails here (same field-ownership pattern). Explicit