fix(installer): schedule cozy-system labeler hook on NotReady-NoSchedule nodes

The pre-install Job runs before any CNI is installed, so all nodes are
tainted NotReady-NoSchedule and the pod has no pod network. Without
adjustment the Job's pod sits Pending until helm's pre-install timeout
fires, blocking the entire install.

Surfaced in PR #2500 CI run 25040584552 attempt 2:
  FailedScheduling  0/3 nodes are available: 3 node(s) had untolerated
  taint {node.kubernetes.io/not-ready: }.

Mirror the cozystack-operator deployment's scheduling pattern:
- hostNetwork=true so the pod doesn't depend on CNI
- Tolerations matching the operator
  (not-ready / unreachable / cilium.agent-not-ready / cloudprovider.uninitialized)
- Variant-aware KUBERNETES_SERVICE_HOST/PORT env so kubectl reaches the
  apiserver before kube-proxy + CNI are up:
    talos:   localhost:7445   (KubePrism)
    generic: cozystack.apiServerHost / Port
    hosted:  default in-cluster

Verified on the sandbox kind cluster that the rendered Job manifest
schedules and the kubectl container starts (the kind cluster itself
doesn't run KubePrism so the env-var path can't be end-to-end-tested
there; the Talos E2E will exercise it).

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

packages/core/installer/templates/cozy-system-labels.yaml

@@ -68,10 +68,39 @@ spec:
     spec:
       serviceAccountName: cozy-system-labeler
       restartPolicy: OnFailure
+      # The hook runs BEFORE Cilium / kube-ovn / any CNI is installed, so the
+      # cluster's nodes are NotReady-NoSchedule and have no pod network. Mirror
+      # the cozystack-operator deployment's scheduling: hostNetwork=true so the
+      # pod doesn't need CNI, plus the same tolerations the operator uses.
+      hostNetwork: true
+      tolerations:
+      - key: "node.kubernetes.io/not-ready"
+        operator: "Exists"
+      - key: "node.kubernetes.io/unreachable"
+        operator: "Exists"
+      - key: "node.cilium.io/agent-not-ready"
+        operator: "Exists"
+      - key: "node.cloudprovider.kubernetes.io/uninitialized"
+        operator: "Exists"
       containers:
       - name: kubectl
         image: alpine/k8s:1.32.0
         imagePullPolicy: IfNotPresent
+        {{- if eq .Values.cozystackOperator.variant "talos" }}
+        env:
+        # Talos KubePrism endpoint — same as cozystack-operator uses to reach
+        # the apiserver before CNI is up.
+        - name: KUBERNETES_SERVICE_HOST
+          value: "localhost"
+        - name: KUBERNETES_SERVICE_PORT
+          value: "7445"
+        {{- else if eq .Values.cozystackOperator.variant "generic" }}
+        env:
+        - name: KUBERNETES_SERVICE_HOST
+          value: {{ required "cozystack.apiServerHost is required in generic mode" .Values.cozystack.apiServerHost | quote }}
+        - name: KUBERNETES_SERVICE_PORT
+          value: {{ .Values.cozystack.apiServerPort | quote }}
+        {{- end }}
         command:
         - kubectl
         - label