fix(shield): prevent stuck allowlist-waiter Job after hook failure

[francesco-furlan]

What this PR does / why we need it:

Fixes a stuck-cluster state observed on a customer running shield-1.37.1 on GKE Autopilot via Flux: when the pre-install shield-host-allowlist-waiter Job times out or fails, Helm's hook executor (per helm/helm pkg/action/hooks.go) applies the HookSucceeded delete-policy to all previously-succeeded hooks in the batch, sweeping the waiter's SA/CR/CRB while the failed Job survives. The Job then loops FailedCreate forever against a missing ServiceAccount.

Four logically separable changes, one commit each (kept independently bisectable):

1. Decouple the waiter SA/CR/CRB from host.rbac.create. They now have their own gke_autopilot.allowlist_waiter.create_rbac and rbac_annotations keys so enabling the waiter without host-shield RBAC no longer produces an orphan Job. Bumps chart to 1.38.0.

2. The core fix:

   • Drop hook-succeeded from the SA/CR/CRB helm.sh/hook-delete-policy so they survive Helm's HookSucceeded sweep on Job failure.
   • Add hook-failed to the Job's helm.sh/hook-delete-policy so a failed Job is reaped instead of looping FailedCreate.
   • AllowlistSynchronizer hook policy unchanged (already before-hook-creation only — it must persist past the waiter).

3. Emit kubectl describe and full YAML of the AllowlistSynchronizer on wait failure, so the next on-caller has actionable diagnostics instead of a bare exit (the customer's first failure was unrecoverable because pod logs were already evicted by the time investigation started). No new RBAC needed.

4. Add gke_autopilot.allowlist_waiter.active_deadline_seconds (default 300) wired into Job.spec.activeDeadlineSeconds. Belt-and-suspenders Job-level guard against pod hangs before the inner kubectl wait timeout fires (image-pull stalls, scheduler delays, admission webhook hangs).

Customer-side remediation (independent of this fix)

For clusters already stuck:

flux suspend helmrelease shield -n sysdig
kubectl delete -n sysdig job/shield-host-allowlist-waiter
kubectl delete allowlistsynchronizer/sysdig-agent-allowlist-synchronizer
helm uninstall shield -n sysdig
flux resume helmrelease shield -n sysdig

Then watch the install hook phase. With the chart fix shipped, the same failure mode produces a clean retry instead of a 5-day FailedCreate storm.

Checklist

• Title of the PR starts with type and scope
• Chart Version bumped for the respective charts (1.37.1 → 1.38.0)
• Variables are documented in the README.md
• Check GithubAction checks (like lint) to avoid merge-check stoppers
• All test files are added in the tests folder of their respective chart and have a "_test" suffix