chore(release): chart 1.4.163→1.4.164 — Wave 17 collector (all 7 t20 fixes baked) (#1687)

t20 diagnostic identified 7 root causes blocking fresh prov convergence;
all 7 PRs merged. This collector bumps chart pin to republish 1.4.164
artifact with everything baked in:

- #1681 harborPublicURL → registry.<sov> (cutover URL chicken-and-egg)
- #1682 single-zone bare listener names (sectionName collision)
- #1683 NATS billing consumer on CATALYST_SME (stream overlap)
- #1684 guacamole mount /home/guacamole (entrypoint rm)
- #1685 newapi-oidc Secret via Helm lookup
- #1686 catalyst-api Containerfile COPY core/services/shared (build pipeline unblocked since #1658)
- Wave 11 hcloud-csi cycle removal (#1610)
- Wave 14 chart 1.4.163 (#1666)
- Wave 15+15b sandbox no-upstream + default-off

Plus deploy-bot auto-bumps: catalyst-api/ui 22f30ce, sandbox-mcp-server.

Per session_2026_05_18_overnight_22prs.md feedback_bootstrap_kit_pin_lag.md:
ALWAYS bump BOTH Chart.yaml + bootstrap-kit pin together.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

clusters/_template/bootstrap-kit/13-bp-catalyst-platform.yaml

@@ -563,7 +563,7 @@ spec:
       # values.yaml sovereign.{enableHotStandby,primaryRegion,
       # replicaRegion} defaults). See Chart.yaml header comment for
       # the full change list.
-      version: 1.4.163
+      version: 1.4.164
       sourceRef:
         kind: HelmRepository
         name: bp-catalyst-platform

products/catalyst/chart/Chart.yaml

@@ -1138,8 +1138,8 @@ name: bp-catalyst-platform
 # Fix #154 (HR-timeout audit). Those bumped the HelmRelease
 # install.timeout. This bumps the chart-INTERNAL wait loop budget
 # inside the pre-install hook Job, which is a different seam.
-version: 1.4.163
-appVersion: 1.4.163
+version: 1.4.164
+appVersion: 1.4.164
 # 1.4.141 (qa-loop Fix #185, prov #38/#39/#41 recurrence — pre-install
 # hook unscheduable on saturated worker):
 #