Fix Tailscale operator HelmRelease for v1.96.x + PodSecurity

- Bump chart version 1.86.x -> 1.96.x
- Migrate operator: -> operatorConfig: (new chart structure)
- Disable OAuth/OIDC to use existing authkey secret
- Add securityContext for restricted:latest PodSecurity policy
- Add podSecurityContext.runAsNonRoot
- Drop ALL capabilities, disable privilege escalation
- Add RuntimeDefault seccomp profile

infrastructure/controllers/base/tailscale/release-operator.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: tailscale-operator
-      version: "1.86.x"
+      version: "1.96.x"
       sourceRef:
         kind: HelmRepository
         name: tailscale
@@ -23,19 +23,26 @@ spec:
     crds: CreateReplace
   values:
     # Operator configuration
-    operator:
+    operatorConfig:
       # Tag to use for pods created by the operator (e.g., tailnet)
-      tags: []
+      hostname: "tailscale-operator"
-      # Auth key from secret - PLACEHOLDER, replace with real key
+      # Auth key via existing secret
-      # Create secret: kubectl create secret generic tailscale-operator-authkey \
+      useOAuth: false
-      #   -n tailscale --from-literal=authkey=tskey-abc123... \
+      useOIDC: false
-      #   --dry-run=client -o yaml | kubectl apply -n tailscale
+      # Concurrency
-      operatorSecretRef:
+      tailscaleOperator:
-        name: tailscale-operator-authkey
+        setConcurrentResourceReconciles: 2
-        key: authkey
+      # PodSecurity "restricted:latest" compliance
-      logFile: "/var/log/tailscale.log"
+      podSecurityContext:
-      # Don't block pod startup if Tailscale auth fails
+        runAsNonRoot: true
-      waitForLinkLocal: false
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+        capabilities:
+          drop:
+            - ALL
     # Disable webhook (optional)
     webhook:
       enabled: false