chore(matrix): derive CI scenario validation from filesystem

[Ian-wang-liyang]

Which problem does the PR fix?

Closes #6340. Stacked on top of #6318 — merge that first; this PR's base
will need to be retargeted to main after the parent lands.

What's in this PR?

Adding or removing a CI scenario, persistence layer, fixture, or
pre-install script under charts/<version>/test/ previously forced an
accompanying edit to the deploy-camunda Go CLI (and therefore a
rebuild/release). The issue called out four concrete coupling points;
this PR eliminates all four so that those operations are pure
YAML/file changes.

1. scenarios.Validate discovers valid names from the filesystem.
validIdentities / validPersistence / validPlatforms slices in
scripts/camunda-core/pkg/scenarios/scenarios.go are gone. Validate
now takes a scenariosDir argument and lists
values/{identity,persistence,platform,features}/*.yaml at call time.
A new helper validateAgainstDir enumerates the actually-available
choices in the error message. Per-version semantics: a name accepted
for 8.10 may now be rejected for 8.7 if the corresponding values file
doesn't exist there (today's behaviour was silent skip; the issue
explicitly asks for "by construction" detection).

If values/<sub>/ doesn't exist at all, validation is skipped for that
dimension (matches ResolvePaths's existing silent-skip semantics for
missing files, and preserves legacy scenarios that don't declare a full
selection vocabulary).

2. BuildDeploymentConfig plumbs scenariosDir. Four production
call sites already had the path on hand — cmd/prepare_values.go,
deploy/values.go (buildDeploymentConfigFromFlags and the inline call
in prepareScenarioValues), and matrix/runner.go (dryRun and
coverageReport). No new infrastructure; just forwards an existing var.

3. Shell completions and flag help text. cmd/root.go and
cmd/prepare_values.go previously duplicated the hardcoded name lists
in both completion functions and flag-help strings. Replaced with a
small discoverCompletions(cmd, scenarios.List*) helper that resolves
the scenario path via the existing resolveScenarioPath, falling back
to the newest in-repo chart-full-setup directory via a glob. If nothing
resolves, completions return nil (cobra treats as "no completions" —
the point is to avoid carrying a stale parallel list).

4. Orphan allowlist moved out of Go. lifecycle_allowlist.go
(hand-maintained Go maps of files exempt from the orphan check) is
deleted. Replaced by a per-chart YAML file
charts/<v>/test/integration/scenarios/.orphan-allowlist.yaml with a
required reason: per entry. Loader: matrix.LoadOrphanAllowlist
(scripts/deploy-camunda/matrix/orphan_allowlist.go). Missing file is
not an error — chart versions with no exemptions don't need a stub.
Both RegistryValidator (load-time) and TestLifecycleFixtures
(make go.test) consult the loader and additionally assert that every
allowlist entry matches an existing file (dead-entry guard, replacing
the cross-version Go map check).

TestLifecycleFixtures now iterates chart-versions.yaml's
ActiveVersions() (alpha + supportStandard = 8.7-8.10) instead of every
directory on disk, so supportExtended series (8.3-8.6) and EOL series
are skipped — their pre-setup-scripts/ hygiene is not asserted.

5. TestGenerate_PropagatesPreInstall de-pinned. The test previously
asserted on Scenario == "rdbms" and the literal postgresql-cluster.yaml
fixture, which broke whenever that one scenario changed shape. Rewritten
to iterate every scenario whose config declares a pre-install hook and
assert that the fixtures/script payload propagates to the Generate'd
entry — property-based, no scenario name baked in. Description is
intentionally NOT compared (dependency-profile composition rewrites it).

Net diff: ~440 / 287 lines across 12 Go files + 4 small YAML
allowlist files (54 lines total). One Go file deleted, one added.

Checklist

Please make sure to follow our Contributing Guide.

Before opening the PR:

• In the repo's root dir, run make go.update-golden-only.
• There is no other open pull request for the same update/change.
• Tests for charts are added (if needed).
• In-repo documentation are updated (if needed).

After opening the PR:

• Did you sign our CLA (Contributor License Agreement)? It will show once you open the PR.
• Did all checks/tests pass in the PR?