Enable Linkerd native sidecar so Job pods terminate cleanly

Without proxy.nativeSidecar=true the linkerd-proxy is injected as a
regular container that never exits. Jobs (notably restate-wi-canary)
get stuck 1/2 NotReady on a failure, so the Job's backoffLimit retry
never fires and a transient first-attempt failure (e.g. GCP IAM
eventual consistency on the Workload Identity binding for a freshly
created env namespace) leaves the env unable to come up.

With native sidecar, the proxy is an init container with restartPolicy:
Always — Kubernetes terminates it when the main container exits, the
pod transitions to Failed/Succeeded, and the Job retries normally.

Author: pcholakov

linkerd.tf

@@ -144,6 +144,16 @@ resource "helm_release" "linkerd_control_plane" {
       name  = "identity.issuer.tls.keyPEM"
       value = tls_private_key.linkerd_issuer.private_key_pem
     },
+    # Run the proxy as a Kubernetes native sidecar (init container with
+    # restartPolicy: Always). Required so that Job pods (restate-wi-canary)
+    # terminate when the main container exits and the Job's backoffLimit can
+    # retry. Without this, the proxy never exits, the pod sticks 1/2 NotReady,
+    # and a transient first-attempt failure (e.g. WI binding propagation race)
+    # leaves the env stuck indefinitely.
+    {
+      name  = "proxy.nativeSidecar"
+      value = "true"
+    },
   ]
 
   depends_on = [helm_release.linkerd_crds]