fix(tests): keep two unit tests green after the release image restamp (#5179)

## What this PR does

Every PR against `release-1.7` has had a red `Unit & controller tests`
check since v1.7.0-rc.3 (seen on #5172,
[job](https://github.com/cozystack/cozystack/actions/runs/41162009892/job/124421449910)).
The cause is the release build itself: the `Prepare release` commit
(04021038f) rewrites `packages/*/values.yaml`, and two unit tests read
exactly the fields it rewrites.

| test | reads | before the release build | after |
|---|---|---|---|
| `hack/cni-plugins-staging-contract.bats` "the kube-ovn release the CNI
plugin pin was checked against is the one vendored" |
`.global.images.kubeovn.tag` in `packages/system/kubeovn/values.yaml` |
`v1.15.26@sha256:…` | `v1.7.0@sha256:…` |
| `packages/system/monitoring/tests/vtraces_collector_test.yaml` "pins
the collector image through the cozy-lib.image helper" |
`tracingCollector.image` |
`docker.io/otel/opentelemetry-collector-contrib:0.136.0@sha256:…` |
`ghcr.io/cozystack/cozystack/otelcol-tracing:v0.136.0-cozystack.0@sha256:…`
|

Changes:

- The bats test now takes the vendored kube-ovn release from
`appVersion` in `packages/system/kubeovn/charts/kube-ovn/Chart.yaml`.
That is the value `packages/system/kubeovn/Makefile` builds the image
from, and a release build leaves it alone. The hint printed on a
mismatch names the new file.
- The helm unittest case no longer names the image at all. It sets
`_cluster.images-registry` and asserts that the registry lands in front
of the rendered image and that the image stays digest-pinned (the
`grafana_upstream_image_plugins_test.yaml` pattern). Removing the
`cozy-lib.image` call from the template makes it fail; the old regex did
not.

Verified locally on this branch: `bats
hack/cni-plugins-staging-contract.bats` 10/10, `helm unittest
packages/system/monitoring -f tests/vtraces_collector_test.yaml` 28/28.

Not a backport: `main` still carries the pre-release pins, so both tests
pass there today. The same patch is open against `main` as #5180, so
`release-1.8` does not meet the same surprise.

Fixes #5178.
Refs #5172 (blocked on this check).

### Downstream repositories

- [x] No downstream repository is affected by this change

### Release note

```release-note
NONE
```

hack/cni-plugins-staging-contract.bats

@@ -22,7 +22,10 @@ extract_has() {
 }
 
 DOCKERFILE="$PWD/packages/system/multus/images/multus-cni/Dockerfile"
-KUBEOVN_VALUES="$PWD/packages/system/kubeovn/values.yaml"
+# The chart's appVersion, not the values.yaml image tag: a release build
+# restamps that tag to the Cozystack version (v1.7.0), the chart keeps the
+# kube-ovn release it vendors.
+KUBEOVN_CHART="$PWD/packages/system/kubeovn/charts/kube-ovn/Chart.yaml"
 DOC="$PWD/docs/vm-external-vlan.md"
 PLATFORM_VALUES="$PWD/packages/core/platform/values.yaml"
 TEMPLATE="$PWD/packages/system/multus/templates/multus-daemonset-thick.yml"
@@ -347,13 +350,12 @@ PATCHFILE="$PWD/packages/system/multus/patches/customize-deployment.patch"
   checked=$(sed -n 's|^# kube-ovn-cni-plugins-checked-against: *\([^ ]*\) *$|\1|p' "$DOCKERFILE")
   [ -n "$checked" ]
 
-  vendored=$(yq -r '.global.images.kubeovn.tag' "$KUBEOVN_VALUES" | sed 's|@.*||')
-  [ -n "$vendored" ]
-  [ "$vendored" != "null" ]
+  vendored=$(awk '$1 == "appVersion:" {gsub(/"/, "", $2); print "v" $2}' "$KUBEOVN_CHART")
+  [ "$vendored" != "v" ]
 
   if [ "$checked" != "$vendored" ]; then
     echo "the multus CNI plugin pin was checked against kube-ovn $checked," >&2
-    echo "but packages/system/kubeovn/values.yaml now vendors $vendored." >&2
+    echo "but packages/system/kubeovn/charts/kube-ovn/Chart.yaml now vendors $vendored." >&2
     echo >&2
     echo "Read CNI_PLUGINS_VERSION in kube-ovn $vendored's base image" >&2
     echo "(dist/images/Dockerfile.base). If it still matches the" >&2

packages/system/monitoring/tests/vtraces_collector_test.yaml

@@ -473,11 +473,18 @@ tests:
           path: spec.template.spec.containers[0].securityContext.capabilities.drop
           content: ALL
 
+  # The image name is not asserted: a release build swaps the upstream
+  # collector for the first-party otelcol-tracing one and restamps the tag.
+  # What must hold is that the value goes through cozy-lib.image (the cluster
+  # images-registry lands in front of it) and stays digest-pinned.
   - it: pins the collector image through the cozy-lib.image helper
+    set:
+      _cluster:
+        images-registry: mirror.example.com
     documentSelector:
       path: kind
       value: Deployment
     asserts:
       - matchRegex:
           path: spec.template.spec.containers[0].image
-          pattern: "opentelemetry-collector-contrib:.*@sha256:"
+          pattern: '^mirror\.example\.com/.+@sha256:[0-9a-f]{64}$'