feat(regions): add opt-in Connectivity Operator beta.2

[Dav-14]

Add an opt-in Connectivity Operator to Regions and Formance, disabled by default. Enabling it requires both the Stack Operator and Ledger Operator flags; invalid combinations fail at render time.

• Stack Operator lock: 3.17.0, using the published v3.17.0 image and matching packaged CRDs. It produces superuser=false Credentials with Core's five required scopes, correcting the previous producer/schema mismatch.
• Ledger Operator chart and explicit image tags: beta.10. Its published image defaults are latest, so the consumer keeps release tags.
• Connectivity Operator chart/default image and Core/API profile selection: beta.2. Remove redundant image overrides and retain generated configuration documentation.
• Shared v4.0-beta profile: Ledger beta.10 / Connectivity beta.2. Existing consumers without higher-precedence versions can adopt this selection independently of the installation opt-in.

Chart cascade: Regions 3.20.6 → 3.21.0; Formance 3.2.4 → 3.3.0.

Validation: full local nix develop --impure --command just pre-commit, 16 Regions/Formance opt-in cases, targeted Stack/Connectivity/Ledger image and profile renders, and git diff --check pass. Stack Operator release run 37807019362 succeeded at 042902be1c5a1682f27b4cdc7e11a3e59b8d974c; both published image architectures carry that revision.

Source contracts now align. This does not qualify a rollout: installed CRD alignment (Regions defaults operator-crds.create=false), existing-resource migration, applied Ledger grants, reflected descriptors, ingestion and recovery remain target gates. No deployment performed.

[NumaryBot]

Findings

[NumaryBot]

Findings

[Dav-14]

Heads-up before merging: the Operator v3.16.0 release is incomplete. The Release workflow pushed the OCI charts operator:3.16.0 / operator-crds:3.16.0, then GoReleaser failed while building operator-utils:v3.16.0-arm64 (DeadlineExceeded from the Namespace remote builder), so ghcr.io/formancehq/operator:v3.16.0 does not exist yet. regions/Chart.lock already resolves operator to 3.16.0; deploying this chart today would fail to pull the operator image. Keep this PR in draft until https://github.com/formancehq/operator/actions/runs/35354205291 completes (rerun in progress).

[Dav-14]

Update: the Operator Release GoReleaser job was re-run and succeeded; ghcr.io/formancehq/operator:v3.16.0 is now published, so the operator 3.16.0 resolution in regions/Chart.lock is deployable. Remaining draft reason: the Connectivity operator pin (0.2.0 / 1.0.0-alpha.1) will move to 1.0.0-beta.0 once that release publishes its chart (EN-2232).

[NumaryBot]

The required automated review completed with no remaining findings.

[NumaryBot]

The required automated review completed with no remaining findings.

[NumaryBot]

The required automated review completed with no remaining findings.

[Dav-14]

Follow-up to the adversarial review on 9f427ca64aeb1c1fa0f00a9fee745bd42999ec74:

• Protocol and Credentials findings are addressed by published Stack Operator 3.17.0, Ledger Operator/Ledger beta.10 and Connectivity beta.2. Independent exact-head source review passes.
• Redundant Connectivity image overrides are removed. Ledger beta.10 tags remain explicit because its chart defaults to latest, without an appVersion fallback.
• Separate validation guards are retained for precise errors and consistency with the existing Ledger guard. All 16 opt-in cases pass.
• Full local pre-commit and targeted image/profile/CRD renders pass. All review threads are resolved; NumaryBot has approved this exact head. Current GitHub CI is still running.

Installed CRD alignment, existing-resource migration, applied grants, ingestion and recovery remain runtime qualification gates. No deployment or merge performed.