[fix] helm fallback: resource adoption, werf-chart guard and telemetry

[Fkuloff]

Overview

Three changes to the nelm → helm3lib fallback path:

1. helm3lib adopts resources the operator pre-applied (TakeOwnership) instead of failing.
2. A chart that uses werf.io/* annotations is never handed to helm3lib.
3. The fallback counter moves under the d8_telemetry_ prefix.

What this PR does / why we need it

Adoption. EnsureConversionWebhooks applies a module's ConversionWebhook before the module's Helm release, so the object exists without Helm ownership markers and the release refuses to import it:

ConversionWebhook "clusterlogdestinations.deckhouse.io" exists and cannot be imported into
the current release: invalid ownership metadata; missing key "app.kubernetes.io/managed-by" ...

Only the helm3lib path is affected — the nelm client already runs with ForceAdoption: true — so a module that falls back never converges. TakeOwnership (helm v3.17+) skips checkOwnership and lets Helm adopt the object and stamp the markers itself, from its own release name and namespace. Not set on the dry-run render action.

werf guard. helm3lib does not implement werf.io/* semantics: ordering (werf.io/weight, werf.io/deploy-dependency-*), tracking (werf.io/track-termination-mode). Handing such a chart to it deploys the module in a different order, silently. The chart sources are now scanned for werf.io/ before falling back; if an annotation is found — or the chart cannot be scanned — nelm's error is reported instead.

Telemetry. helm_fallback_total → d8_telemetry_helm_fallback_total, so Flant telemetry collects how often releases silently degrade to helm3lib. Labels unchanged. The prefix is hardcoded because addon-operator cannot import Deckhouse's telemetry.WrapName, and InitMetrics applies a single prefix to every metric.

Verified on a cluster, A/B with only the addon-operator version changed: without the fix the module stays in Error with invalid ownership metadata and retries forever; with it the module converges and Helm stamps the ownership markers on the pre-applied webhook itself.