chore(eks): update management add-on prerequisites for 1.35

[plural-copilot]

Summary

Prerequisite GitOps updates for the management EKS 1.35 upgrade. No live infrastructure was modified.

• Bump the runtime chart from 0.1.36 to 0.1.37.
• Update both runtime ingress-nginx dependencies—the public ingress-nginx release and the ingress-nginx-private alias—from chart 4.14.1 to 4.15.0.
• Regenerate the runtime dependency lock/archive through Helm. The vendored ingress-nginx 4.15.0 metadata and local render confirm controller appVersion 1.15.0.
• Bump management Gatekeeper from chart 3.15.1 to 3.21.1 in resources/policy/services/gatekeeper.yaml. Gatekeeper is an independent GlobalService source, not part of the runtime chart packaging; its targeting and values remain unchanged.

Validation

• helm dependency update charts/runtime
• helm lint charts/runtime (passed; only an existing informational icon recommendation)
• Local, cluster-free helm template runtime charts/runtime --namespace runtime --include-crds
• Inspected vendored ingress-nginx archive metadata and rendered controller image: 1.15.0
• Verified Gatekeeper 3.21.1 chart availability and parsed its YAML with yq

A Kubernetes client dry-run for Gatekeeper was attempted but its custom deployments.plural.sh resource requires CRD discovery from a cluster; no cluster access was used. Add-ons must reconcile successfully before upgrading management EKS to 1.35.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create exactly ONE prerequisite PR on top of main in pluralsh/bootstrap for management EKS 1.35 blockers. Do not modify live infrastructure. First inspect exact sources and preserve all existing values/activation behavior....
🔗 Run history	View run history