fix(bootstrap-kit): revert bp-keycloak 1.5.0 → 1.4.1 — Fix #53A keycloak-config-cli incompatibility blocks fresh provisions (#1282)

Fix #53A's chart 1.5.0 introduced sovereignRealm.name parameterization but
the keycloak-config-cli post-install hook fails BackoffLimitExceeded on
fresh installs (omantel re-provision 46bb19cec1854858 hung phase1-watching
30+ min, all bp-* HRs stuck on bp-keycloak dependency).

Per feedback_punish_back_to_zero.md no SSH allowed for diagnosis. Fix #54
flagged this as unverified. Reverting to chart 1.4.1 default-realm-name
(sovereign) until config-cli compatibility is fixed.

Loses Fix #53A's 8 KC realm-name TC unblocks, but unblocks the entire
provision chain. To re-introduce later: ensure keycloak-config-cli realm
import works on first install, not just on subsequent ones.

clusters/_template/bootstrap-kit/09-keycloak.yaml

@@ -45,7 +45,7 @@ spec:
       # parameter so each Sovereign owns its KC realm named after the tenant
       # short-name (omantel chroot → "omantel"). Default `sovereign` is kept
       # in the chart for backward compat with overlays not yet migrated.
-      version: 1.5.0
+      version: 1.4.1
       sourceRef:
         kind: HelmRepository
         name: bp-keycloak