Bundle solver includes kafka 4.x without kafka-controller, causing permanent `blocked: application needs to be related with a KRaft controller`

**Note: This issue was generated with AI assistance (GitHub Copilot) based on automated log analysis and triage.**
Filed by @canonical/solutions-qa

## Summary

When the bundle solver (z3) selects `kafka` (4/stable) as a neighbor application to satisfy an interface endpoint, it does not also include a `kafka-controller` application. Kafka 4.x dropped ZooKeeper support and requires a KRaft controller relation to start — without it, the unit is immediately and permanently blocked:

```
application needs to be related with a KRaft controller
```

This makes `test_deploy` time out whenever kafka 4.x is selected as a bundle neighbor.

## Observed in

- **Test plan**: `integration/lego:certificates/tls-certificates/etcd:certificates`
- **Artefact**: etcd rev 736, track 1.27/beta
- **Failing test result**: `test_deploy` (id 12700172)
- **Test execution**: 337666
- **CI run**: https://github.com/canonical/charm-integration-testing/actions/runs/30893117026
- **Test Observer**: https://test-observer.canonical.com/#/charms/338010?testExecutionId=337666&testResultId=12700172

## Bundle context

The bundle solver added kafka to satisfy lego's mandatory `send-ca-cert/certificate_transfer` endpoint:

```
INFO Iteration 4
INFO Problem is unsatisfiable; expanding domain
INFO Expanded domain to handle failed assertion tag:
kind=CHARM_ENDPOINT_NON_OPTIONAL
charm=lego (endpoint='send-ca-cert', interface='certificate_transfer')
```

The generated bundle included kafka rev 248 (4/stable) as a neighbor but no `kafka-controller`. At timeout:

```
App Version Status Rev Message
kafka 4.1.1 blocked 248 application needs to be related with a KRaft controller
```

Juju status at timeout (from `test_resource_consistency_report` io_log):
```
Unit Workload Agent Machine Public address Message
kafka/0* blocked idle 1 10.141.161.8 application needs to be related with a KRaft controller
```

Machine 1 (kafka) was ACTIVE with an IP — the machine provisioned successfully, but the charm is permanently blocked without the KRaft controller relation.

## Expected behaviour

When kafka 4.x is selected as a bundle neighbor, the bundle solver should also include a `kafka-controller` application (and the required `kafka:cluster/kafka-controller/cluster` integration), or select an alternative charm for the `certificate_transfer` interface that does not have mandatory companion relations.

## Environment

- Charm: `kafka` rev 248, channel 4/stable (version 4.1.1)
- Environment: `juju:3/stable ubuntu:20.04 openstack` (amd64)
- Juju version: 3.6.27
- Pipeline ref: de61417

Start with the integration/lego:certificates/tls-certificates/etcd:certificates test plan and reproduce the test_deploy failure, then trace the bundle solver's expansion of the mandatory certificate_transfer endpoint. Check the generated bundle and the test_resource_consistency_report output. Done means a kafka 4.x neighbor has the required kafka-controller application and integration, or an alternative is selected, without test_deploy timing out.

Written by the indexing model from the issue text.