[Dav-14]

Summary

Fix EN-2807, coordinating with Connectivity Core #524 / EN-2806:

existing Connectivity Credentials
  → reconcile five canonical Ledger RC.2/RC.3 scopes in place
  → wait for observedGeneration
  → preserve key identity and distributed Secret references

Replace ledger:AccountRead/LedgerWrite/TransactionWrite/MetadataWrite/QueryWrite with ledger:ReadAccount/WriteLedger/WriteTransaction/WriteMetadata/WriteQuery. Retain non-superuser access and existing ownership/readiness checks.

Prepare v3.21.2 in this PR: bump both Helm charts to 3.21.2 / appVersion: v3.21.2 and regenerate the Operator dependency lock, following release PR #573. This prepares the release; no version tag has been created or published.

Evidence

• Before: main 347d671d produces RC.1 grants; current Ledger requires canonical names.
• After: regression covers old-grant migration, exact values, unchanged credential UID/key ID/Secret, stale Ready rejection, observed-generation convergence and idempotent repeated reconciliation.
• Release preparation: official Nix just pre-commit passed again after the chart bump, including strict Helm lint/template checks and dependency-lock regeneration.
• Passed official Nix go test -race ./internal/resources/connectivities -count=1 and just pre-commit, with no generated drift.
• Independent source review: Principal Engineer, Product Engineer and SRE pass for code; runtime grant application remains a deployment gate. Initial Nix disk-exhaustion failure was resolved and the official commands rerun successfully.

Merge Danger

Door: coordinated rollback.

Blast Radius: Stack-managed Connectivity.

This is a behavioral breaking change for Core versions still claiming RC.1 names. Upgrade Core and the Operator together against Ledger RC.2/RC.3; reverting only the desired grants can interrupt ingestion. No CRD/API or persisted-data migration is introduced, and no extra privilege is granted. David explicitly authorized an Operator breaking change in Codex on 2026-11-06; no merge was requested.

Kubernetes Credentials readiness confirms distribution, not that the Ledger Cluster controller applied registered-key grants. Verify actual scoped provisioning and ingestion after rollout. No deployment has occurred yet.

[NumaryBot]

The required automated review completed with no remaining findings.