chore(ci): use unified ci-rwo storage class and add storage-class policy check

[wuhuizuo]

What

• Replace all hyperdisk-rwo references (508 files, 793 occurrences) with the cluster-agnostic ci-rwo storage class name, across Jenkins pipelines (pipelines/, jobs/), Prow jobs (prow-jobs/), and Tekton templates (tekton/).
• Add .ci/verify-storage-class-policy.sh + .ci/storage-class-policy-allowlist.txt that fail when a manifest references a storage class outside the allowlist (ci-rwo, plus legacy ceph-block used by tekton/v0 on the prod rook-ceph cluster; ${STORAGE_CLASSNAME_*} env indirections in tekton/v1 are always allowed).
• Wire it as a new always-run presubmit pull-verify-storage-class-policy in prow-jobs/pingcap-qe/ci/presubmits.yaml.

Why

Storage class names are cluster-specific (fresh GKE clusters ship standard-rwo/standard/premium-rwo/dynamic-rwo but not hyperdisk-rwo), so hardcoding cluster-specific names makes CI configs fail on new clusters. ci-rwo is a unified name provisioned per cluster by PingCAP-QE/ee-ops (see ee-ops PR #2172), letting CI configs stay cluster-agnostic.

Note

This is a rename-only change; the ci-rwo StorageClass (hyperdisk-balanced, 10000 IOPS / 400Mi) has already been created in the prow cluster, so jobs keep working after merge.

Related

• feat(infrastructure): add unified ci-rwo storage class for gcp and tencentcloud ee-ops#2172: add unified ci-rwo storage class for gcp and tencentcloud

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign wuhuizuo for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

@wuhuizuo: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-replay-jenkins-pipelines	02aeb8d	link	false	/test pull-replay-jenkins-pipelines

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.