refactor: make external-dns values provider-aware

[Matthiator]

📝 Summary

Prepares the first small split from #370 by refactoring the built-in ExternalDNS Helm values for provider-specific configuration.

The existing Stackit-specific ExternalDNS settings are now rendered conditionally from terraform.provider, while provider-independent values remain shared. This establishes the supported pattern for adding further provider-specific ExternalDNS configuration without duplicating complete Helm values files.

Additional changes made while preparing this split and addressing review feedback:

• Treat provider-specific template directories only under terraform/providers/<provider>/; Helm provider behavior stays in shared values templates or charts.
• Introduce a dedicated TerraformProvider type and centralize supported Terraform provider validation.
• Introduce terraform.provider: none as the default to support clusters without Terraform-managed infrastructure.
• Skip Terraform template generation for clusters without Terraform config during default kubara generate.
• Keep kubara generate --terraform strict and require a supported Terraform provider.
• Avoid rendering a provider-derived Velero VolumeSnapshotClass when Terraform is disabled.
• Handle existing clusters without Terraform during kubara init --overwrite.
• Document the Terraform-only provider template layout and the catalog boundary for app-specific behavior.

🧩 Type of change

• 🔧 CLI / Go code
• 📦 Helm chart
• 🧱 Terraform module
• 📝 Documentation
• 🧪 Test or CI change
• ♻️ Refactor / cleanup

⚠️ Is this a breaking change?

• Yes, this change breaks existing functionality (explain in summary)

No intended breaking changes to supported behavior. Existing Stackit ExternalDNS values are preserved when terraform.provider: stackit is configured.

Clusters without Terraform config, or with terraform.provider: none, can now use the default kubara generate flow without forcing --helm.

🧪 Testing

• CI passed
• Manually tested (local/dev cluster)
• Unit tested
• Not tested (explain why below)

Ran locally:

• cd src && make test
• cd src && go test ./internal/workflow ./cmd ./internal/config ./internal/render -count=1
• make docs-validate
• git diff --check

🔗 Related Issues / Tickets

• First preparatory split from feat: add T Cloud Public CCE provider support #370
• Follow-up to feat(terraform): add provider-aware template scaffold without default provider #167

✅ Checklist

• Code compiles and passes all tests
• Linting and style checks pass
• Comments added for complex logic
• Documentation updated (if applicable)

📎 Additional Context (optional)

This PR intentionally covers the ExternalDNS values preparation plus the provider handling needed to make terraform.provider: none a valid no-Terraform state.

It does not include T Cloud Public provider registration, OpenBao integration, Terraform modules, or the remaining provider-specific Helm changes from #370.