fix(redis): reject TLS for Redis 5

[weicao]

Problem

Redis 5.0.12 does not provide the TLS server/client capability used by the addon, but all three Redis 5 ComponentDefinitions advertised spec.tls. With tls: true, KubeBlocks injected REDIS_CLI_TLS_CMD=--tls --insecure while the Redis 5 startup scripts launched a plaintext server. Exact runtime evidence showed all three shard Pods exhaust readiness attempts because redis-cli rejects --tls; plaintext password-auth PING remained healthy.

This failure happens before parent PR #3190 partial-join injection, so it is a separate capability-contract bug. See #3221.

Solution

• omit spec.tls from Redis 5 data, cluster, and sentinel ComponentDefinitions;
• preserve the full TLS contract for Redis 6/7/8;
• rely on KubeBlocks fail-closed validation when a user requests TLS against a definition that does not support it; never downgrade silently to plaintext;
• inherit Chart 1.2.0-alpha.5 and Redis 5/6 slot-owner routing from parent PR fix(redis): version definitions and recover restored replication #3190;
• keep a structured Helm/YAML contract over the exact Redis family/version definition set, cardinality, and startup-script routing.

This PR is stacked on PR #3190 exact 31e4a0950244e4ecc86c1b3d6bccd8bcd9b13df9.

TDD and validation

• Original RED showed all Redis family/version definitions advertising TLS and reported the three Redis 5 violations.
• Exact current head: 8f1a9cb53e265da321ac136b01ad80f51daadaa2; tree d50c6f4d45075b9f7b0200feda17035c5452a31d.
• Rebase range-diff keeps both TLS commits patch-equivalent; the parent is exactly the new PR fix(redis): version definitions and recover restored replication #3190 head and alpha.5 is preserved.
• TLS contract Bash 5: 1/0; macOS Bash 3: 1/0.
• Parent classifier + TLS + Redis 5 + replica-recovery focused set: 28/0.
• Full Redis Bash 5 ShellSpec: 552/0.
• Bash syntax, ShellCheck error severity, git diff --check, Helm lint, Helm template, alpha.5 render and routing: PASS.
• Focused review is terminal NO BLOCKER. The reviewer verified stable patch-id equivalence and exact parent ancestry.
• GitHub CI is terminal 7/7 PASS: ShellSpec, shell-check, four chart checks, and generate-files.

Review focus

• the capability boundary: Redis 5 must expose no TLS contract, Redis 6/7/8 must remain unchanged;
• fail-closed behavior with no plaintext downgrade;
• exact definition-set/cardinality test so an extra or missing definition cannot false-green;
• stacked inheritance: only the two TLS commits sit above exact parent 31e4a095.

Runtime boundary

All older alpha.2/alpha.3/alpha.4 runtime evidence belongs to older source identities and does not transfer. Exact alpha.5 runtime is N=0. Max now owns fresh exact-head validation for Redis 5 tls:true rejection with Pod=0, Redis 5 password-only partial-join/restart, unchanged Redis 6/7/8 TLS+password/ACL behavior, and the shared shard-expansion contract. This source/render proof is not runtime PASS or release-ready.

Fixes #3221

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 30 lines in your changes missing coverage. Please review.
✅ Project coverage is 0.00%. Comparing base (31e4a09) to head (8f1a9cb).

Files with missing lines	Patch %	Lines
...scripts-ut-spec/redis_tls_version_contract_spec.sh	0.00%	30 Missing ⚠️

Additional details and impacted files

@@                           Coverage Diff                           @@
##           maya/redis-versioned-definitions-task97   #3218   +/-   ##
=======================================================================
  Coverage                                     0.00%   0.00%           
=======================================================================
  Files                                          155     156    +1     
  Lines                                        25027   25057   +30     
=======================================================================
- Misses                                       25027   25057   +30     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.