fix: remove nodeport for nats in kind/environments/values

## What

Brings the SRM single-bootstrap change (originally fix/srm-control-path-bootstrap by @togias) onto the 2.0 chart layout, so the chart works with SRM develop (TF-SDK 2.0.0rc4).

SRM develop now reads control paths only from the bootstrap topology, and TF-SDK rc4 needs in_cluster: true for the local cluster plus a writable /var/run/openop-tfsdk. Without this MR, an SRM 2.0.0 image built from current develop can't deploy workloads with our chart.

Supersedes fix/srm-control-path-bootstrap. Its two commits are ported here under @togias's name.

Changes

• Control paths only in srm.topology. The srm.controlPaths value is retired: setting it now fails rendering with a migration message. CONTROL_PATH_SETTINGS__ENTRIES is no longer passed to SRM.
• Remote-cluster credentials. New srm.controlPathCredentials value mounts an existing kubeconfig Secret under /etc/openop/kubeconfigs/. The chart checks at render time that each mount matches a control path's kubeconfig_path in the topology.
• TF-SDK runtime directory. SRM always gets an emptyDir at /var/run/openop-tfsdk, where TF-SDK writes Helm's temporary files.
• kind values. controlPaths removed; in_cluster: true added to the k8s-local control path.
• Docs and tests. SRM README section rewritten (one bootstrap, credentials, release compatibility pinned to SRM develop 8fdb12a with TF-SDK 2.0.0rc4). New tests/test_srm_bootstrap.py with pytest render checks.

Only change from @togias's originals: value paths follow the flat 2.0 layout (srm.topology instead of srm.srmcontroller.topology).

Breaking for existing values

Anyone setting srm.controlPaths must move those entries into control_paths inside srm.topology. Kubernetes control paths for the cluster SRM runs in need in_cluster: true. Rendering fails with a clear message until they do.

Tested

On kind, with SRM 2.0.0 built from develop 8fdb12a (TF-SDK 2.0.0rc4):

• helm lint and the 8 pytest render checks pass.
• Fresh install through scripts/helm-deploy.sh: all pods ready; SRM loads the topology with no controlPaths.
• End-to-end cases, 11/11 passing:
  • Helm-chart and container app deploys into oop-apps
  • instance create, list and terminate
  • QoD create, get and delete through a mock NEF declared only in the topology
  • location retrieval
• The retired srm.controlPaths value is refused with the migration message. ``