Set the external-dns hostname annotation under both the alpha and new prefix

[WalBeh]

Summary of changes

external-dns v0.22.0 changes the default annotation prefix from external-dns.alpha.kubernetes.io/ to external-dns.kubernetes.io/, with no fallback to the old prefix. The operator now sets the hostname annotation under both prefixes (option 1 in the issue: "two won't hurt") on:

• the data service (_lb_annotations_to_add, plus removal via _lb_annotations_to_remove when switching to Traefik)
• the grand-central nginx Ingress

Both keys live in constants.py with a note to drop the alpha one once all external-dns controllers are confirmed on v0.22.0+.

For existing clusters (item 2 in the issue), devtools/backfill_external_dns_annotation.py — a uv script (PEP 723 inline metadata, click CLI) — copies the alpha annotation's value to the new key on operator-managed Services and Ingresses only, selected via app.kubernetes.io/managed-by=crate-operator,app.kubernetes.io/part-of=cratedb. It dry-runs by default, takes --apply to patch and --context to pick a kubeconfig context, skips resources that already have the new annotation, and reports per-resource failures without aborting the sweep (non-zero exit if any). Run once per region:

uv run devtools/backfill_external_dns_annotation.py --context <ctx>          # dry run
uv run devtools/backfill_external_dns_annotation.py --context <ctx> --apply

Still out of scope: pinning --annotation-prefix / bumping external-dns on the deployments in kubernetes-gitops (item 3).

Checklist

• Link to issue this PR refers to: https://github.com/crate/cloud/issues/3080
• Relevant changes are reflected in CHANGES.rst
• Added or changed code is covered by tests
• Documentation has been updated if necessary
• Changed code does not contain any breaking changes (or this is a major version change)

🤖 Generated with Claude Code

[tomach]

LGTM! 💯