chore(recipes): bump 7 components to upstream latest (phase 1)

Phase 1 of the version refresh tracked in #698: minor and patch
bumps across registry defaults and overlay/mixin pins. No values
schema changes required.

  aws-ebs-csi-driver       2.55.0  -> 2.59.0
  cert-manager             v1.17.2 -> v1.20.2
  kube-prometheus-stack    82.8.0  -> 84.4.0
  kubeflow-trainer         2.1.0   -> 2.2.0
  kueue                    0.17.0  -> 0.17.1
  nodewright-operator      v0.14.0 -> v0.15.1
  nvsentinel               v1.1.0  -> v1.3.0

Excluded from this PR:
- kgateway / kgateway-crds (v2.0.0 -> v2.2.3) — v2.2.3 silently
  drops the `inferenceExtension.enabled` value (no longer in the
  chart's values.yaml). v2.0.0 renders inf_ext_rbac.yaml
  (ClusterRole granting access to inference.networking.x-k8s.io
  inferencemodels/inferencepools) plus KGW_ENABLE_INFER_EXT env;
  v2.2.3 renders neither. AICR uses kgateway specifically for the
  CNCF AI Conformance "Advanced Ingress for AI/ML Inference"
  requirement, so a silent feature regression here would break
  inference bundles. Migration to v2.2.3 needs a values + RBAC
  rework — deferred.
- aws-efa (v0.5.3 -> v0.5.26) — 23 minors require values cleanup
  including a real security-posture change (chart now defaults to
  privileged: true for EFA hardware access, conflicting with our
  hardened allowPrivilegeEscalation: false override). Deferred to
  a follow-up so the change can get proper EKS/security review.
- kai-scheduler (v0.13.0 -> v0.14.1) — GitHub release v0.14.1 was
  published as a chart tarball asset but never pushed to the OCI
  registry at ghcr.io/nvidia/kai-scheduler/kai-scheduler. v0.13.0
  is the latest fetchable OCI tag. Bump deferred until upstream
  catches up.

Also resync vendor/github.com/go-openapi/strfmt/{README,CONTRIBUTORS}.md
with the v0.26.2 content already declared in vendor/modules.txt.
The prior dep-update commit on main bumped strfmt to v0.26.2 in
modules.txt but didn't refresh those two doc files, so `go mod
vendor` in CI produces a diff against the committed vendor and
the `tests/Test` gate fails. Running `go mod vendor` here picks up
the consistent v0.26.2 docs.

Refs: #698

Author: yuanchen8911

recipes/overlays/base.yaml

@@ -34,7 +34,7 @@ spec:
     - name: cert-manager
       type: Helm
       source: https://charts.jetstack.io
-      version: v1.17.2
+      version: v1.20.2
       valuesFile: components/cert-manager/values.yaml
 
     - name: gpu-operator
@@ -52,7 +52,7 @@ spec:
     - name: nvsentinel
       type: Helm
       source: oci://ghcr.io/nvidia
-      version: v1.1.0
+      version: v1.3.0
       valuesFile: components/nvsentinel/values.yaml
       dependencyRefs:
         - cert-manager
@@ -61,13 +61,13 @@ spec:
     - name: nodewright-operator
       type: Helm
       source: https://helm.ngc.nvidia.com/nvidia/skyhook
-      version: v0.14.0
+      version: v0.15.1
       valuesFile: components/nodewright-operator/values.yaml
 
     - name: kube-prometheus-stack
       type: Helm
       source: https://prometheus-community.github.io/helm-charts
-      version: 82.8.0
+      version: 84.4.0
       valuesFile: components/kube-prometheus-stack/values.yaml
 
     - name: k8s-ephemeral-storage-metrics

recipes/overlays/eks.yaml

@@ -38,7 +38,7 @@ spec:
     - name: aws-ebs-csi-driver
       type: Helm
       source: https://kubernetes-sigs.github.io/aws-ebs-csi-driver
-      version: 2.55.0
+      version: 2.59.0
       valuesFile: components/aws-ebs-csi-driver/values.yaml
 
     # Enable Prometheus persistent storage for EKS (requires EBS CSI driver)

recipes/registry.yaml

@@ -143,7 +143,7 @@ components:
     helm:
       defaultRepository: https://charts.jetstack.io
       defaultChart: jetstack/cert-manager
-      defaultVersion: v1.17.2
+      defaultVersion: v1.20.2
       defaultNamespace: cert-manager
     nodeScheduling:
       system:
@@ -226,7 +226,7 @@ components:
     helm:
       defaultRepository: https://helm.ngc.nvidia.com/nvidia
       defaultChart: nvidia/nvsentinel
-      defaultVersion: v1.1.0
+      defaultVersion: v1.3.0
       defaultNamespace: nvsentinel
     nodeScheduling:
       system:
@@ -267,7 +267,7 @@ components:
     helm:
       defaultRepository: https://prometheus-community.github.io/helm-charts
       defaultChart: prometheus-community/kube-prometheus-stack
-      defaultVersion: 82.8.0
+      defaultVersion: 84.4.0
       defaultNamespace: monitoring
     nodeScheduling:
       system:
@@ -318,7 +318,7 @@ components:
     helm:
       defaultRepository: https://kubernetes-sigs.github.io/aws-ebs-csi-driver
       defaultChart: aws-ebs-csi-driver/aws-ebs-csi-driver
-      defaultVersion: 2.55.0
+      defaultVersion: 2.59.0
       defaultNamespace: kube-system
     nodeScheduling:
       system:
@@ -455,7 +455,7 @@ components:
     helm:
       defaultRepository: oci://registry.k8s.io/kueue/charts
       defaultChart: kueue
-      defaultVersion: "0.17.0"
+      defaultVersion: "0.17.1"
       defaultNamespace: kueue-system
     nodeScheduling:
       system:
@@ -474,7 +474,7 @@ components:
     helm:
       defaultRepository: oci://ghcr.io/kubeflow/charts
       defaultChart: kubeflow-trainer
-      defaultVersion: 2.1.0
+      defaultVersion: 2.2.0
       defaultNamespace: kubeflow
     nodeScheduling:
       system: