fix(byoc-i): support Kite storage identities

[santiago-wjq]

Summary

AWS BYOC-I

• include the Kite coordinator and index-pool service accounts in newly created storage-role trust policies
• grant the maintenance role only iam:GetRole and iam:UpdateAssumeRolePolicy on the exact storage role
• keep customer trust customizations intact while the companion infra-agent reconciles existing roles additively

GCP BYOC-I

• always merge vectorlake-kite/kite-coordinator and vectorlake-kite-pool/kite-index-pool-sa into the storage service account Workload Identity members
• keep caller-provided identities and stable Terraform resource addresses
• retain the cluster-scoped principalSet grant for runtime instance namespaces
• document the explicit Kite grants

Existing dataplanes

AWS roles are repaired by the companion infra-agent after the maintenance-policy update is applied. GCP dataplanes receive the two explicit IAM members when customers rerun terraform apply.

Validation

• OpenTofu fmt -check -diff
• isolated tofu init -backend=false and tofu validate for modules/gcp_byoc_i/iam
• git diff --check

CloudFormation is intentionally out of scope because BYOC-I is provisioned through these Terraform modules.

[santiago-wjq]

Coordinated rollout PRs:

• zilliz-cloud #8734
• terraform-zilliz-examples #150
• paas-deploy #125
• vdc-deploy #2006
• vdc-deploy-prod #2133

Recommended rollout: apply the Terraform maintenance-role permission first, publish the zilliz-cloud infra-agent image, sync paas/vdc chart values, enable the infra-api readiness gate, then promote the production overlays.

[santiago-wjq]

Scope correction: BYOC-I does not use CloudFormation. All CloudFormation and mode 1 trust-template changes have been removed, and production overlay PR #2133 was closed. The active AWS rollout PRs are zilliz-cloud #8734, merged terraform-zilliz-examples #150, paas-deploy #125, and vdc-deploy #2006. Explicit GCP BYOC-I Kite Workload Identity members are in follow-up terraform-zilliz-examples #151.