fix(dataprotection): preserve backup namespace for cross-namespace restores

[leon-ape]

Fixes #10829.

Problem

Generated Restore objects used the target Cluster/RestoreManager namespace as spec.backup.namespace instead of the referenced Backup namespace. For cross-namespace backups this could fail to find the source Backup or restore from a same-name Backup in the target namespace.

VolumeSnapshot data sources are namespace-scoped, so cross-namespace VolumeSnapshot restores cannot be supported by the current restore flow. This boundary must be checked after resolving incremental, differential, and continuous backup dependencies because PITR may select a VolumeSnapshot base Backup even when the entry Backup is not snapshot-based.

What changed

• Preserve backupObj.Namespace in generated prepare-data and post-ready Restore objects.
• Keep the existing default support for cross-namespace Backup references; this change does not introduce ReferenceGrant or a new authorization contract.
• Keep the existing TODO for a future general cross-namespace permission check.
• Resolve the complete restore backup chain first, then reject any cross-namespace VolumeSnapshot Backup in PrepareDataBackupSets with a fatal validation error before PVC restore processing.
• Validate and initialize the restore manager before restoring system-account Secrets, so a rejected restore cannot create or overwrite target credentials.
• Preserve the VolumeSnapshot marker when continuous restore selects a base Backup, so PITR base snapshots are covered by the validation.
• Reject a PITR-selected base Backup without status.backupMethod with a fatal error instead of panicking while reading snapshotVolumes.
• Explicitly document cross-namespace VolumeSnapshot restore as NOT supported and regenerate CRDs and API reference docs.
• Add focused tests for namespace propagation, default cross-namespace Backup support, direct VolumeSnapshot rejection, PITR base snapshot rejection, missing PITR base Backup method, and validation-before-credential-mutation ordering.
• Synchronize the branch with the latest main.

Compatibility

This is intentionally a limited, backward-compatible change. Existing non-VolumeSnapshot cross-namespace Backup references continue to work without additional resources or API requirements. System-account Secrets are still restored before prepare-data or post-ready execution; only deterministic restore validation now runs first.

Backports

• release-1.1: fix(dataprotection): preserve backup namespace for cross-namespace restores #10833
• release-1.0: fix(dataprotection): preserve backup namespace for cross-namespace restores #10834

Both release branches are affected by the namespace and VolumeSnapshot validation issue and require independent backports because that diff does not cherry-pick cleanly onto their release-specific controller and test layouts. The system-account Secret ordering change is main-only because the release VolumePopulator does not contain the Backup-backed credential restoration path.

Validation

• scripts/codex-go-test.sh ./controllers/dataprotection ./pkg/dataprotection/restore -count=1
• scripts/codex-go-test.sh ./pkg/dataprotection/restore ./pkg/controller/plan ./controllers/dataprotection -count=1
• make manifests
• make doc
• git diff --check

All targeted tests pass on the pushed branch head.

[apecloud-bot]

Auto Cherry-pick Instructions

Usage:
  - /nopick: Not auto cherry-pick when PR merged.
  - /pick: release-x.x [release-x.x]: Auto cherry-pick to the specified branch when PR merged.

Example:
  - /nopick
  - /pick release-1.1

CLA Recheck Instructions

Usage:
  - /recheck-cla: Trigger a re-check of CLA status for this pull request.
Example:
  - /recheck-cla

[codecov]

Codecov Report

❌ Patch coverage is 84.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.78%. Comparing base (3e85bbc) to head (cee4554).

Files with missing lines	Patch %	Lines
pkg/dataprotection/restore/utils.go	70.00%	2 Missing and 1 partial ⚠️
pkg/controller/plan/restore.go	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10827      +/-   ##
==========================================
+ Coverage   65.67%   65.78%   +0.11%     
==========================================
  Files         510      510              
  Lines       64639    64652      +13     
==========================================
+ Hits        42451    42532      +81     
+ Misses      18413    18366      -47     
+ Partials     3775     3754      -21     

Flag	Coverage Δ
unittests	65.78% <84.00%> (+0.11%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[leon-ape]

/approve

[leon-ape]

/approve

[leon-ape]

/approve

[leon-ape]

/approve