chore: update CozyStack upstream to v1.5.2

[kingdonb]

🤖 Automated CozyStack Dependency Update

This PR updates our CozyStack upstream release pin.

Changes:

• Release: v1.5.2
• Released: 2026-07-03T12:14:23Z
• Patch compatibility: failure

Changes in v1.5.2 (since v1.5.1)

ab0f9ed chore(release): cut v1.5.2 (#3161)
7cc5df5 Prepare release v1.5.2
ccb325e [Backport release-1.5] fix(kamaji): backport datastore unused-deletion deadlock fix (clastix/kamaji#1122) (#3187)
a114736 fix(kamaji): backport datastore unused-deletion deadlock fix (clastix/kamaji#1122)
3e25f19 [Backport release-1.5] fix(kubernetes): gate vmop cert-manager-crds dependency on certManager.enabled (#3185)
5378a53 fix(kubernetes): gate vmop cert-manager-crds dependency on certManager.enabled
4da2f42 [Backport release-1.5] fix(tenant): gate VM-resource HelmReleases on victoria-metrics-operator readiness (#3166)
943f2b0 [Backport release-1.5] fix(mariadb): re-guard replication so single-replica passes the operator webhook (#3183)
e441b2d [Backport release-1.5] fix(kubernetes): make node group resources optional when instanceType is set (#3156)
746f873 [Backport release-1.5] fix(seaweedfs): enforce read-only bucket access by bumping cosi-driver to v0.3.1 (#3153)
d490ebb [Backport release-1.5] fix(platform): order backupstrategy-controller after cozystack-basics (#3079)
7799ec4 [Backport release-1.5] fix(kafka): set entity-operator resources to avoid OOM under tenant LimitRange (#3054)
e115e62 test(mariadb): fix operator MariaDB CR name in single-replica failure dump
b5a09cd fix(mariadb): re-guard replication so single-replica passes the operator webhook
6cca847 fix(tenant): gate VM-CR-creating HelmReleases on victoria-metrics-operator
0dbd0e1 fix(kubernetes): make node group resources optional and prefer them over instanceType
46d5d9d fix(seaweedfs): enforce read-only bucket access by bumping cosi-driver to v0.3.1
76f2964 [Backport release-1.5] fix(harbor): preserve jobservice and trivy storageClass on upgrade (#3147)
e676165 [Backport release-1.5] fix(seaweedfs): point S3 consumers at the reachable S3 service (#3127)
dad7458 fix(harbor): preserve jobservice and trivy storageClass on upgrade

🧪 Pre-flight Checks

• Latest non-prerelease release tag identified
• Patch compatibility tested
  - [ ] ⚠️ Patch conflicts detected - manual review required

🚀 Next Steps

1. Review the upstream changes above
2. Verify CI pipeline passes with new upstream
3. Test ARM64 build with new CozyStack version
4. Merge when ready

---

This PR was automatically created by the dependency update workflow