Update enhancement: control plane migrator, status field, deprecate backupKey

- Deploy kube-storage-version-migrator in HCP namespace (control plane)
  instead of data plane, enabling re-encryption with zero worker nodes
- Disable data-plane operator via annotation removal in
  cluster-kube-storage-version-migrator-operator repo
- Add status.secretEncryption.activeKey field to HC/HCP with full key
  spec for rotation detection and EncryptionConfiguration resilience
- Deprecate backupKey spec fields in favor of status-based tracking
- Update workflow, architecture, risks, and support procedures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: muraee