fix: bootstrap local app store platform dependencies

[bugkeep]

Problem

A number of App Store charts can reach Helm resource creation but still fail in a local CasOS cluster because the cluster bootstrap path is missing platform dependencies that standard Kubernetes distributions usually provide by default.

Observed symptoms included:

• in-cluster DNS lookup failures for service names
• PVC scheduling/binding stalls for charts using StatefulSets or persistent storage
• Deployment expose flows needing better selector and port inference

Root Cause

CasOS already has the Kubernetes API/resource shape, but the local runtime layer did not consistently provide DNS and default storage capabilities expected by common Helm charts. This made failures look like chart/network issues even when the underlying gap was in the local cluster substrate.

Fix

• Bootstrap a CasOS-managed CoreDNS path for fresh local clusters, while skipping takeover when an existing kube-system/kube-dns Service is not managed by CasOS.
• Bootstrap a local-path provisioner and default local-path StorageClass for local PVC workloads.
• Keep existing StorageClass CRUD behavior safe: if local-path already exists, bootstrap only reconciles default-class annotations instead of overwriting mutable UI-edited fields like reclaim policy or expansion.
• Make CoreDNS/local-path images configurable through server config keys while preserving the current defaults.
• Improve Deployment expose inference by deriving selectors and ports from all containers rather than assuming only the first container.
• Remove unrelated apiserver flag changes from this PR so the diff stays focused on platform bootstrap.

Review Follow-ups Addressed

• Rebased onto current upstream master, including the StorageClass CRUD work.
• Avoided overwriting user-edited local-path StorageClass fields on restart.
• Preserved Kubernetes-managed ServiceAccount fields and Service immutable/operational fields during reconciliation.
• Added guardrails around existing non-CasOS kube-dns Services to avoid silently taking over a distribution-provided DNS Service.
• Added local-path helper path validation before setup/teardown removes directories.
• Kept one PR to one commit.

Validation

• go test ./server ./controllers
• ocr review --from origin/master --to HEAD --format json --audience agent
• Verified this branch contains exactly one commit on top of upstream master.

OCR Notes

Final OCR completed successfully. No Critical/High findings remained.

Remaining Medium/Low items are follow-up/product tradeoffs rather than required fixes for this PR:

• helper pod still runs as root because local-path setup/teardown must create, chmod, and remove node filesystem directories
• CoreDNS Service type is preserved to avoid disrupting an existing running DNS Service, though this also means CasOS does not force it back to ClusterIP
• StorageClass default annotation reconciliation still uses Get/Update without conflict retry
• CoreDNS/Corefile/resource tuning and HA replica count are still fixed defaults

Scope

This PR targets local App Store platform dependencies. It intentionally does not try to solve chart-specific default values, third-party repository quality, or every production-grade Kubernetes distribution option in one patch.