[bmscomp]

Release prep for v1.28.0: image and kates-tester pins, chart versions and version tables. There are 9 commits since v1.27.0 (#437 to #445): namespace-scoped installs, the Kafka namespace and cluster name followed everywhere, kates-platform fixes, .labels, and two book chapters.

• kates chart 0.12.1 → 0.12.2, with appVersion and image tags at 1.28.0. Its change entry names the Kates API changes:
  • the conformity check runs under rbac.scope=namespace's Role, with zones from EndpointSlices, and answers 503 when the Kafka CR's get is refused (feat(chart,conformity): rbac.scope=namespace runs tests and conformity checks without cluster admin #439);
  • a fault with no targetNamespace is aimed at kates.chaos.kafka.namespace, not the literal kafka (fix(chaos): a fault that names no targetNamespace is in the Kafka cluster's namespace, wherever it is #442).
• Strimzi charts: strimzi-operator 0.3.7, kafka-cluster 1.0.11, connect-cluster 2.1.9 and mirror-maker2 0.11.7, all pinning kates-tester:1.28.0. Nothing under tester/ changed since 1.27.0.
• Other pins: the 12 Litmus experiment pins, kates/k8s/deployment.yaml, the registry docs and runbook, Recipe 7's KATES_VERSION (docs/book/14-recipes.md, new in docs(book): Recipe 7 gates a CI pipeline on Kafka, on either install mode #443), the README chart table and appendix D.

Deliberately not done: kates-platform's subchart floors stay where #438/#441 set them (kates >=0.12.1); 0.12.2 changes only the pins, so the umbrella doesn't need a bump.

Checked locally

• scripts/check-versions.sh, gen-chart-table.sh --check and gen-version-matrix.sh --check all pass.
• helm lint passes on all five bumped charts (dependencies built in a scratch copy).
• check-book-style.sh, check-chart-test-paths.sh, TestMCPCaveatRefAnchors and yamllint on the edited YAML pass.
• main was green on every workflow at daad5962.

Next: after merge, tag v1.28.0 on the merge commit to start the Release workflow.