Clarify Kubernetes storage helper support boundaries

[dholt]

Summary

• Keep the NFS subdir external provisioner as the simple default DeepOps Kubernetes storage path and document it as a non-HA convenience path; update the chart pin to 4.0.18.
• Refresh NetApp Trident defaults and docs to Trident 26.02.1 with Helm chart 100.2602.1; remove real-looking sample backend addresses and embedded sample credentials from defaults and config.example; make backend/StorageClass/snapshot creation explicit opt-in.
• Require explicit opt-in (DEEPOPS_ENABLE_DEPRECATED_ROOK=true) for the deprecated Rook/Ceph helper and point users to the documented storage support boundaries instead.
• Clarify the storage support boundary docs: default NFS path, optional/community-supported Rook/Ceph and Trident paths.

Validation

• git diff --check origin/master..HEAD
• YAML parse for changed group vars, playbooks, and role files; bash -n for changed shell scripts
• Focused Ansible syntax checks for playbooks/k8s-cluster/nfs-client-provisioner.yml and playbooks/k8s-cluster/netapp-trident.yml
• Full role lint: 0 failures, 0 warnings
• Helm template renders for the NFS subdir provisioner and Trident charts, and a Rook opt-in gate smoke (validated on the identical pre-rebase content; the rebased diff is patch-identical)
• OS compatibility audit high=0, medium=0, low=45, info=30; component audit moves Kubernetes storage helpers to keep with the documented boundaries (review=6, keep=3)
• Public sanitizer check on the PR body

Notes

• This is a defaults/docs/opt-in hygiene change; it does not remove the Trident or Rook code paths.
• Removed sample values in example configs were replaced with clearly-fake placeholders and opt-in documentation.