## What this PR does
The nats, kafka-metadata and rabbitmq backup demos carried the two
empty-read defects the redis demo already fixed.
**Empty read from an attach race (nats, kafka-metadata).** Both
seed/verify helpers ran each CLI call in a throwaway `kubectl run -i`
pod. That pod's stdout returns over an attach that only carries what the
container writes after the attach registers, so a CLI that finishes
first comes back empty with exit 0. Neither NATS nor Kafka ships a
long-lived pod that carries its CLI (unlike rabbitmq, which already
execs `rabbitmqctl` in its `-server-0` pod), so each demo now runs one
long-lived CLI pod and `kubectl exec` into it: an exec'd process owns
its pipes, so its output cannot be lost that way, and stderr stays
attached so a failed read says why. `cleanup.sh` removes the pod.
**Single read of the platform strategy (rabbitmq, kafka-metadata).**
Both runners read the platform's `cozy-default-<engine>` strategy once,
right after install, where the Helm upgrade that renders it is gated on
`dependsOn` and can be absent for minutes. Both now `kubectl wait
--for=create` for it, so it polls through NotFound and fails only on a
real error.
Unit tests for the two rewritten helpers are added under `hack/`, in the
`cozytest.sh` dialect, and assert the reply comes back through exec (a
throwaway run pod makes the stub fail).
Validation: kafka-metadata and rabbitmq are exercised by their in-tree
chainsaw E2E suites. The nats demo has no chainsaw suite in this
repository, so its change is covered by the unit test only.
### Screenshots
No UI changes.
### Downstream repositories
<!-- Walked the trigger map in docs/agents/contributing.md against the
diff. The change is confined to examples/backups/* demo scripts, one
demo README, and two hack/*.bats files. No repository's trigger matches:
it touches no packages/apps, no values.schema.json, no
ApplicationDefinition, no platform values, no hack/package.mk or make
target, and no commit convention. -->
- [x] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:
- [ ] [cozystack/community](https://github.com/cozystack/community) -
follow-up:
### Release note
```release-note
fix(backups): stop the nats, kafka-metadata and rabbitmq backup demos from reading empty CLI output
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Improvements**
* Kafka and NATS backup demos reuse their CLI pods and limit cleanup to
pods belonging to the respective demo.
* NATS commands no longer include the password in the server URL, and
command errors remain visible.
* The RabbitMQ demo waits for its backup strategy to appear and reports
missing backup images more clearly.
* **Tests**
* Added coverage for reusing or creating demo pods, ownership checks,
password handling, and command failures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Aleksei Sviridkin
b981ea7f26