Support pure Helm bootstrap for compute-plane registration

Description

Make self-managed NVCF installation support compute-plane registration through a pure Helm or Helmfile workflow, without requiring an operator to build and install nvcf-cli locally.

The current registration flow requires the CLI to establish PKI trust and generate or consume the control-plane profile. For now, the Helmfile BDDs are being repaired with a script, but the productized flow should ship the CLI in a versioned container and run the bootstrap from Kubernetes. This should also leave a path toward an Argo-style GitOps workflow.

Definition of Done

• A fresh self-managed install can initialize/authenticate and register the compute plane using Helm or Helmfile alone; no host-installed nvcf-cli is required.
• A Helm-launched bootstrap Job or equivalent runs the supported CLI image with explicit control-plane and compute-cluster contexts.
• The generated control-plane profile, trust material, and registration output are persisted in appropriate Kubernetes resources and consumed by the rest of the installation; sensitive token/config data is stored securely.
• The bootstrap is idempotent and retry-safe, with documented configuration values, RBAC, image/version selection, and failure handling.
• Automated tests cover clean-install behavior and verify that registration uses the matching profile and CLI configuration.
• Installation and operator documentation describe the pure-Helm bootstrap and the interim/manual CLI path, if still supported.

Resources

• Related BDD failure: https://github.com/NVIDIA/nvcf/issues/1254
• Current BDD fixes: https://github.com/NVIDIA/nvcf/pull/1262
• Slack discussion: https://nvidia.slack.com/archives/C0AJ45GK08J/p1787841082786169