[License Exception Request] [Cozystack] [MPL-2.0] Vendored unmodified RabbitMQ operator manifests and OpenBao Helm chart

### For which CNCF project are you requesting exceptions?

Cozystack

### Are you an official maintainer of this project?

Yes

### List of components requiring an exception

| Component | Upstream URL | Project Usage URL | License(s) | Purpose |
|---|---|---|---|---|
| RabbitMQ cluster-operator release manifests | https://github.com/rabbitmq/cluster-operator | https://github.com/cozystack/cozystack/tree/main/packages/system/rabbitmq-operator | MPL-2.0 | Vendored unmodified upstream release YAML backing the optional RabbitMQ catalog app |
| RabbitMQ messaging-topology-operator release manifests | https://github.com/rabbitmq/messaging-topology-operator | https://github.com/cozystack/cozystack/tree/main/packages/system/rabbitmq-operator | MPL-2.0 | Same |
| OpenBao Helm chart | https://github.com/openbao/openbao-helm | https://github.com/cozystack/cozystack/tree/main/packages/system/openbao | MPL-2.0 | Vendored unmodified upstream chart backing the optional OpenBao catalog app |

### Distribution and integration model

- [x] **CNCF-Distributed**: The CNCF project will distribute the dependency or the resulting combined artifacts to users.
- [x] **User-Fetched Dependency**: The CNCF project code will cause the user's system to automatically retrieve the dependency from an upstream source at build, install, or runtime.
- [ ] **System Component**
- [ ] **Not Distributed + Not Needed by End User (Internal Project Tooling)**

### Please explain

The vendored manifests and chart are committed to the repository and republished within the `cozystack-packages` OCI packaging artifact (CNCF-Distributed). The operator and server container images they reference are pulled by the user's cluster from upstream registries (User-Fetched). Both integrations are optional catalog items, disabled by default.

### Modification status

- [ ] **Modified Upstream**
- [ ] **Modified Downstream**
- [x] **Unmodified**: The CNCF project will use the dependency exactly as provided by the upstream maintainers without any changes to its source code.

### Please explain

Upstream files are vendored byte-for-byte; our Makefiles re-fetch them from upstream releases on update. Upstream license notices are retained.

### Structural separation

- [x] **Separated Component**: The dependency's code will either be (a) kept in a distinct directory or module clearly separated from CNCF project code, or (b) retrieved at build/installation time from a third-party repository and never stored in the CNCF project repository.
- [ ] **Intermingled Code**

### Please explain

Each component lives in its own designated directory (`packages/system/rabbitmq-operator/templates`, `packages/system/openbao/charts/openbao`).

### Communication mechanism

- [ ] **Static Linking**
- [ ] **Dynamic Linking**
- [x] **Separate Process**: The dependency and the CNCF project code will run as distinct executables and communicate via Inter-Process Communication (e.g., pipes, sockets, or shared files)
- [ ] **Network Interaction**

### Please explain

The operators and servers run as their own containers; Cozystack interacts with them via the Kubernetes API.

### Data exchange

- [ ] **Tightly Coupled**
- [x] **Arms-Length Only**: The communication between the dependency and the CNCF project code will be limited to standard serialized data (e.g., JSON, XML, or Protobuf) where data is "flattened" for transport and neither component accesses the other's internal memory structures.

### Please explain

Kubernetes API objects (JSON/Protobuf) only.

### Additional information

This matches the standard scope of previously granted MPL-2.0 exceptions: "stored unmodified in a designated third-party folder, or retrieved at installation or build time". MPL-2.0's file-level scope leaves the surrounding Apache-2.0 project unaffected. Filed as part of a license-hygiene pass ahead of Cozystack's Incubation review (related: #1465).

Review the CNCF license-exception criteria against the vendored paths `packages/system/rabbitmq-operator/templates` and `packages/system/openbao/charts/openbao`, then compare them with the linked RabbitMQ operator and OpenBao upstream repositories. Confirm that the files are unmodified, separated, and retain license notices; done means the exception request receives a documented governance decision.

Written by the indexing model from the issue text.