[3/3] Test historical bootstrap RBAC migration

[Alex Huang (wenhug)]

Summary

• add a focused real-cluster migration from official v0.1.0 to the current build
• verify explicit and idempotent removal of the legacy bootstrap system:node binding
• prove bootstrap-token node access changes from HTTP 200 to 403, then 401 after revocation
• reissue the daemon certificate using the retained CSR permissions
• prove the daemon certificate can GET its exact Node without relying on optional cluster-wide Node-list permission
• restart kubelet and daemon while preserving Node UID, readiness, and Lease renewal
• correct service-asset modes when upgrading a historical installation

Stack

• Depends on [1/3] Restrict Flex Node bootstrap token RBAC #287 and [2/3] Harden E2E state, cleanup, and Arc diagnostics #288.
• This is part 3 of the replacement for Restrict Flex Node bootstrap token RBAC #286.

This branch targets wenhug/e2e-cleanup-hardening, so its review contains only the historical compatibility scenario and the small upgrade-mode fix it exposed. After the lower PRs merge, it will be rebased and retargeted to main.

The PR's own diff remains limited to the historical migration proof. The complete stack also inherits the Arc authorization diagnostics added to #288 while investigating the E2E pipeline failure.

Scenario

1. Download and SHA-verify official v0.1.0 artifacts.
2. Join a real VM as a Ready node with the historical configuration and RBAC.
3. Upgrade the same host to the current build.
4. Verify both kubelet and daemon certificate identities and exact-Node authorization.
5. Run the explicit migration twice.
6. Reissue the daemon certificate, revoke the old token, and restart services.
7. Confirm the same node remains Ready and continues renewing its Lease.

Validation

• make check
• go test -race ./hack/e2e
• focused historical migration tests
• workflow YAML parsing
• ShellCheck and bash -n
• independent pre-push scope and correctness audit
• final focused E2E run passed on 790f408 in 36m17s, including scenario execution, evidence upload, cleanup, residual-resource verification, and cleanup diagnostics