Component catch-up batch 1: external-dns 1.21, oauth2-proxy 10.x, Alloy 1.x, CNPG in-place flag

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/externaldns/helmrelease.yaml

@@ -11,7 +11,7 @@ spec:
   chart:
     spec:
       chart: external-dns
-      version: ">=1.15.0 <1.16.0"   # TODO(WS-NET): pin at bring-up; Renovate maintains
+      version: ">=1.21.0 <1.22.0"   # k8s-1.36 catch-up (app v0.21; policy already set). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: external-dns