Complete the low-risk half of the Sentry -> Cairn OBS rebrand

Sweeps the references that carry no runtime coupling, and fixes one that
turned out to be a real bug rather than stale branding.

Docker network: sentry_default -> cairnobs_default across 23 runbook and
test-header `docker run` commands. Compose derives the network from the
directory name, so this lands together with renaming the working copy to
cairnobs/ -- the two are only correct as one change.

Stale references corrected: four Dockerfile "repo root (sentry/)"
headers; .env pointing at the long-renamed deploy/helm/sentry/ chart;
five Helm comments describing the topic as sentry.logs.raw when all four
code paths have defaulted to cairnobs.logs.raw for some time; an
absolute /home/john/Projects/sentry/ path in the operator's package doc,
now repo-relative; the hand-written Tenant CRD description in both of
its identical copies, whose Go source already said Cairn OBS.

Migration 0043 repoints the default tenant's data source. 0026 seeded it
with ('sentry', '/var/lib/sentry-search') to match what
api/internal/config then defaulted to; the rebrand later moved those
defaults to "cairnobs" and /var/lib/cairnobs-search without moving the
already-applied row, leaving the default tenant naming a ClickHouse
database nothing writes to. Scoped to the exact stale values so it is a
no-op on any deployment that set them deliberately. 0026's comment is
annotated as superseded; its applied SQL is untouched.

Deliberately not included: the gRPC wire packages (sentry.logs.v1,
sentry.agent.v1) and proto/sentry/ import paths, which cannot change
without a lockstep agent/server upgrade; the Helm chart's
sentry_metadata database and sentry role, which need a real Postgres
migration on existing deployments; and the compliance audit records in
docs/compliance/, which are a dated historical record.

go build, go vet, and go test pass for ingest and deploy/operator.

deploy/helm/cairnobs/crds/cairnobs.io_tenants.yaml

@@ -33,7 +33,7 @@ spec:
         openAPIV3Schema:
           type: object
           description: >-
-            Tenant is the K8s-native representation of one Sentry tenant's
+            Tenant is the K8s-native representation of one Cairn OBS tenant's
             deployment-topology state -- see
             deploy/operator/internal/controller/tenant_controller.go's doc
             comment for what the controller does and does not manage.

deploy/helm/cairnobs/templates/enterprise-ingest.yaml

@@ -1,7 +1,7 @@
 {{/*
 Only rendered once per-tenant write-routing is actually turned on (see
 ingest.yaml's -mode=server comment) -- this Deployment is what takes
-over consuming sentry.logs.raw once ingest.yaml's own consumer half
+over consuming cairnobs.logs.raw once ingest.yaml's own consumer half
 stops, routing each record to its own tenant's dedicated ClickHouse
 database (enterprise/internal/chwriter) instead of the one shared table.
 No Service: this is a pure background worker, nothing calls it, only

deploy/helm/cairnobs/templates/ingest.yaml

@@ -26,7 +26,7 @@ spec:
           # -mode=server only: this Deployment stops running the
           # ClickHouse-writing consumer half (the default -mode=all)
           # once per-tenant write-routing is on -- enterprise-ingest.yaml
-          # (below) takes over consuming sentry.logs.raw instead, so it
+          # (below) takes over consuming cairnobs.logs.raw instead, so it
           # can write each tenant's records to their own database rather
           # than the one shared table ingest's own consumer always
           # writes to. The agent-facing server half (PushBatch, tenant

deploy/helm/cairnobs/templates/redpanda.yaml

@@ -72,7 +72,7 @@ spec:
     - name: admin
       port: 9644
 ---
-# One-shot: creates the sentry.logs.raw topic. Same image
+# One-shot: creates the cairnobs.logs.raw topic. Same image
 # transport/Dockerfile builds for docker-compose.yml's redpanda-provision
 # service. Deliberately a plain Job, not a Helm hook -- see
 # deploy/helm/cairnobs/README.md's "Startup ordering" section for why

deploy/helm/cairnobs/values.yaml

@@ -79,7 +79,7 @@ ingest:
   # -create-ingest-credential-tenant=<id>`) or be refused outright. Also
   # controls per-tenant write-routing: true switches ingest.yaml's
   # Deployment to -mode=server only and renders enterprise-ingest.yaml
-  # to take over consuming sentry.logs.raw, writing each tenant's
+  # to take over consuming cairnobs.logs.raw, writing each tenant's
   # records into their own ClickHouse database instead of the one
   # shared table -- both flags gate together since write-routing is only
   # meaningful once records actually carry a tenant_id to route on.
@@ -164,7 +164,7 @@ enterprise:
     tag: latest
   # enterprise-ingest (templates/enterprise-ingest.yaml) -- only
   # rendered when ingest.requireTenantCredential is also true (see that
-  # value's comment); takes over consuming sentry.logs.raw from
+  # value's comment); takes over consuming cairnobs.logs.raw from
   # ingest.yaml's own consumer once per-tenant write-routing is on. Same
   # "repo root build context" reasoning as apiImage above -- see
   # enterprise/cmd/enterprise-ingest/Dockerfile.

deploy/operator/api/v1alpha1/groupversion_info.go

@@ -1,7 +1,7 @@
 // Package v1alpha1 contains the Tenant API's Go types -- kubebuilder's
 // standard api/<version>/ layout, hand-written rather than scaffolded
 // (no kubebuilder/controller-gen binary available in this environment;
-// see /home/john/Projects/sentry/deploy/README.md's verification
+// see /deploy/README.md's verification
 // section for what that means for this package specifically: it's real,
 // compiling, unit-tested Go code, never reconciled against a live
 // cluster).

deploy/operator/config/crd/cairnobs.io_tenants.yaml

@@ -33,7 +33,7 @@ spec:
         openAPIV3Schema:
           type: object
           description: >-
-            Tenant is the K8s-native representation of one Sentry tenant's
+            Tenant is the K8s-native representation of one Cairn OBS tenant's
             deployment-topology state -- see
             deploy/operator/internal/controller/tenant_controller.go's doc
             comment for what the controller does and does not manage.