fix: use explicit Clusters Service ARM helper config

[roi (roivaz)]

https://redhat.atlassian.net/browse/AROSLSRE-1776

What

Make the Clusters Service chart consume only clustersServiceArmHelperClientId and clustersServiceArmHelperCertName. The chart no longer reads the Backend armHelperClientId or armHelperCertName fields and contains no identity fallback logic.

Configuration owns identity sharing explicitly:

• environments with a dedicated Clusters Service identity set the CS fields to that identity;
• environments sharing the Backend identity set both pairs to the same client ID and certificate;
• single-lease CI copies the leased Backend pair into the CS fields, while two-lease CI keeps the pairs distinct.

Focused Helm fixtures cover shared and distinct identity configurations.

Why

The original split in #6454 performed fallback in preprocessed cluster-service/values.yaml. In EV2 resolve mode, the dedicated references became non-empty __...__ placeholders, so the conditional selected them before EV2 substituted INT's real empty values. Helm received empty helper fields, omitted the ARM-helper flags and certificate mount, and Clusters Service fell back to the mock FPA for CheckAccess V2.

#6476 restored the shared identity as an incident mitigation. Keeping environment migration policy out of the chart makes the re-land simpler and removes the entire placeholder/fallback failure class: Clusters Service has one explicit configuration pair, and each environment decides which identity populates it.

openshift/release PR #83084 remains on hold until this chart support is ready.

Testing

• make verify-materialize
• Cluster Service Helm fixtures with shared and distinct identity pairs
• Bash syntax validation and ShellCheck for hack/ci/build-config-override.sh
• Single-lease override generation produces identical Backend and CS pairs
• Two-lease override generation produces distinct Backend and CS pairs
• check-ev2-render semantic guard
• sdp-pipelines EV2 resolve-mode generation for Microsoft.Azure.ARO.HCP.ClusterService

Special notes for your reviewer

The large generated portion consists of the two standard Helm fixtures. The dedicated identity infrastructure and configuration fields introduced by #6454 remain unchanged.

PR Checklist

• PR is scoped to a single task (no mixed concerns)
• Title follows Conventional Commits format
• Summary explains the "Why" behind the change
• Linked to relevant ticket/issue
• Screenshots included (not applicable)
• Self-reviewed the diff
• CI/CD checks are passing (ignore Tide)
• Draft PR used for WIP
• Commit history is clean (will squash before marking ready)
• Tricky code blocks are commented (not applicable)
• Specific reviewers tagged
• All comment threads resolved before merge

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: roivaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• cluster-service/OWNERS [roivaz]
• docs/OWNERS [roivaz]
• hack/OWNERS [roivaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment