Odp/gardener revendor - #316

Reconciles 173 upstream commits (mostly Renovate dependency bumps) on top of
the Gardener v1.144.1 revendor. Only go.mod/go.sum conflicted; resolved by
keeping this branch's dependency tree (gardener v1.144.1 supersedes upstream's
pinned v1.106.1). Absorbs upstream's renovate.json and CI script updates.

Verified: go mod tidy is a no-op, go build/vet/test ./pkg/... all pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Also MCM v0.62.1 and hcloud-go v2.44.0. x/net moves to v0.56.0, clearing 7
advisories.

v1.146 removed the gardener/gardener/hack package and hack/vgopath-setup.sh.
The latter was sourced by update-codegen.sh under errexit, which broke make
generate and therefore the release workflow that builds
example/controller-registration.yaml. vgopath is replaced by the hack/tools
nested module, pinned to v1.146.4 in lockstep with core: hack/tools v1.147.0
requires controller-runtime v0.24.1 and k8s v0.36.2, which MVS would propagate
to the whole staging set. k8s.io/* stay at v0.35.5 and controller-runtime at
v0.23.3 to match gardener v1.146.4 exactly.

WorkerPoolHash merged additionalDataV1/V2 into a single additionalData
parameter. The computed hash is unchanged for a nil-additionalData call, so no
MachineClass is renamed and no worker pool rolls. The worker mock never set
NodeAgentSecretName and so exercised the V1 hash fallback that v1.146 removed;
gardenlet always sets the field, so the fixture now matches production.

Hetzner stops returning Datacenter.ServerTypes after 2026-10-01 and has
deprecated the datacenters API. Availability is now derived from
ServerType.Locations. Also stop discarding the API error, which previously
turned any API failure into a bogus "machine type not available" for every
pool.

CCM v1.33.0 and csi-driver v2.22.0. csi-node-driver-registrar v2.17.0 and
livenessprobe v2.19.0 are pure CVE fixes with no flag or RBAC changes.
csi-attacher, csi-resizer and csi-provisioner stay on the matrix that
csi-driver v2.22.0 pins and tests. Go builder to 1.26.5, matching gardener.

controller-runtime v0.24.x and VPA v1.7.x require k8s v0.36, which would
silently break alignment with gardener v1.146.4, and gomod PRs were set to
automerge. Group the gardener modules so core, pkg/apis and hack/tools move
together.

…e manager

Everything was on node12/node16-era pins from ~2020; Node 20 is removed from
runners on 2026-09-16. All eight actions now declare node24.

setup-go was floating on go-version ">=1.21.0", which silently tracked newest
stable rather than the go directive; it now reads go.mod.

github-actions was missing from enabledManagers, which is why these pins rotted
while gomod stayed current. Enabling it after the bump means no backlog of
per-major PRs.

The removed hack/vgopath-setup.sh ran `go mod download` internally. Without it,
`go list -m -f {{.Dir}}` returns empty on a cold cache, so CODE_GEN_DIR was
empty and update-codegen.sh sourced /kube_codegen.sh. The Makefile also
resolves GARDENER_HACK_DIR and GARDENER_TOOL_DIR the same way at parse time,
before any recipe runs, so the workflow downloads first. The GOPATH export was
only needed by vgopath.

Signed-off-by: Christian Hüning <christianhuening@users.noreply.github.com>

Adopt the extension into the opendefensecloud org. Renames the module
path github.com/23technologies/gardener-extension-provider-hcloud ->
github.com/opendefensecloud/gardener-extension-provider-hcloud across all
imports, go.mod, the Dockerfile (WORKDIR + image.source label), README and
docs. No functional change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- Makefile REGISTRY/PROJECT_NAME -> opendefensecloud
- provider + admission chart image repositories -> ghcr.io/opendefensecloud
  (admission reconciled to the CI-published name gardener-extension-admission-hcloud)
- charts/images.yaml machine-controller-manager-provider-hcloud image,
  sourceRepository and renovate depName -> opendefensecloud (tag unchanged)
- CODEOWNERS team -> @opendefensecloud/developers
- regenerate example/controller-registration.yaml

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Result of `make tidy` — refreshes vendored .github issue/PR templates to
match the current gardener dependency (crypto label guidance, internal-info
notices). No functional change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>