gate hot-standby HA pending paired release

[bpopadiuk]

Codex (GPT-5): Temporarily gates hot-standby HA off for the current Antfly release while preserving an explicit opt-in and manual verification path pending the paired Antfly and Colony changes.

Why

Hot-standby HA is present on current Antfly main, but it is not release-ready until antflydb/antfly#347 and antflydb/colony#346 land together. Required Zig aggregates also include the HA suites today, so HA-specific flakes can block an otherwise unrelated release build.

What changed

• Add --enable-hot-standby-ha, defaulting to false, and pin the shipped operator Deployment manifest to false.
• Reject new or updated spec.highAvailability.mode: HotStandby resources at admission while disabled.
• Enforce the same boundary in the reconciler before finalizers, topology normalization, or workload mutation when webhooks are unavailable.
• Keep deletion and updates that disable HA available. Existing HA workloads are left untouched while the controller reports a ConfigurationValid=False status and backs off.
• Add -Dha-tests to Zig aggregate test selection. Required PR, push, merge-queue, and scheduled workflow runs pass -Dha-tests=false; manual workflow dispatch passes -Dha-tests=true.
• Keep standalone ha-test, ha-chaos-test, and HA compatibility targets available for explicit verification.

Cloud boundary

Current Colony main does not yet expose the HA admission/configuration surface, so it remains effectively off without adding an unused environment variable in this release. Colony PR #346 owns the Cloud-side default-off COLONY_CLOUD_HA_ADMISSION_ENABLED boundary. The intended rollout is to merge the paired Colony #346 and Antfly #347 changes, verify that exact pair, then explicitly enable both gates.

Impact

Non-HA clusters are unchanged. Hot-standby HA requests fail closed with an actionable message until the operator is restarted with --enable-hot-standby-ha=true. Required CI stops depending on the gated HA suites; manual and standalone HA validation remains available.

Validation

• GOCACHE=/private/tmp/antfly-ha-release-gate-full-gocache make test from go/pkg/operator — passed, including generate, fmt, vet, and all Go tests.
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/zig-tests.yml — passed.
• zig build -Dha-tests=false --help with isolated caches — passed; aggregate option and standalone HA targets are registered.
• make -n zig-unit-test ZIG_BUILD_FLAGS=-Dha-tests=false — confirmed the root Makefile forwards the gate into the Zig build.
• git diff --check — passed.

This intentionally does not address unrelated failures already present on main.