Component catch-up batch 1: external-dns 1.21, oauth2-proxy 10.x, Alloy 1.x, CNPG in-place flag

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/oauth2-proxy/helmrelease.yaml

@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: oauth2-proxy
-      version: ">=7.0.0 <8.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      version: ">=10.0.0 <11.0.0"   # k8s-1.36 catch-up (app v7.15.x). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: oauth2-proxy