fix(monitoring): use a valid match-nothing selector for parca-analytics (#474)

The In: [] selector from the previous PR is rejected by Kubernetes'
own API validation (In/NotIn require a non-empty values set), which
made Prometheus Operator's reconciliation fail outright:

  selecting ServiceMonitors failed: values: Invalid value: []string(nil):
  for 'in', 'notin' operators, values set can't be empty

Confirmed live: prometheus-analytics kept scraping thanos-sidecar/
thanos-query/thanos-store after that PR merged, because it never
regenerated its scrape config at all. matchLabels on a label nothing
carries has no such non-empty-set constraint and reliably matches
zero objects.

Author: metalmatze

monitoring/environments/scaleway-parca-demo/main.jsonnet

@@ -338,11 +338,13 @@ local prometheuses = [
         // job, see monitoring's serviceMonitorParcaAnalytics). The default {}
         // selectors match every PodMonitor/ServiceMonitor cluster-wide, so without
         // this it would also pick up unrelated apps (parca-agent, pyrra, ...) plus
-        // its own Thanos components. `In: []` never matches, regardless of labels.
+        // its own Thanos components. matchLabels on a label nothing carries never
+        // matches; unlike `In: []`, the Kubernetes API accepts this (`In`/`NotIn`
+        // reject empty values sets and fail Prometheus Operator's reconciliation).
         podMonitorNamespaceSelector: { matchLabels: { 'kubernetes.io/metadata.name': p._config.namespace } },
         serviceMonitorNamespaceSelector: { matchLabels: { 'kubernetes.io/metadata.name': p._config.namespace } },
-        podMonitorSelector: { matchExpressions: [{ key: 'prometheus', operator: 'In', values: [] }] },
-        serviceMonitorSelector: { matchExpressions: [{ key: 'prometheus', operator: 'In', values: [] }] },
+        podMonitorSelector: { matchLabels: { 'prometheus-operator-select-nothing': 'true' } },
+        serviceMonitorSelector: { matchLabels: { 'prometheus-operator-select-nothing': 'true' } },
         resources+: {
           requests+: { cpu: '500m' },
         },