fix: reset and force nfs helmrelease during bootstrap

When the NFS storage HelmRelease has already entered a failed remediation state,
a plain reconcile request is not enough to clear the stale failure counters.
Send requestedAt, resetAt, and forceAt together so helm-controller retries the
release cleanly before the workflow waits on addon-nfs-storage.

.gitea/workflows/deploy.yml

@@ -244,7 +244,11 @@ jobs:
           EOF
           # Wait for the storage layer and private access components
           TS=$(date --iso-8601=seconds)
-          kubectl -n flux-system annotate helmrelease/nfs-subdir-external-provisioner reconcile.fluxcd.io/requestedAt="$TS" --overwrite || true
+          kubectl -n flux-system annotate helmrelease/nfs-subdir-external-provisioner \
+            reconcile.fluxcd.io/requestedAt="$TS" \
+            reconcile.fluxcd.io/resetAt="$TS" \
+            reconcile.fluxcd.io/forceAt="$TS" \
+            --overwrite || true
           kubectl -n flux-system annotate kustomization/addon-nfs-storage reconcile.fluxcd.io/requestedAt="$TS" --overwrite || true
           kubectl -n flux-system wait --for=condition=Ready helmrelease/nfs-subdir-external-provisioner --timeout=600s
           kubectl -n flux-system wait --for=condition=Ready kustomization/addon-nfs-storage --timeout=600s