feat: make K8s operator private and add registry EE warning

Move K8s operator source code (crd, db_sync, reconciler, resolve) to
windmill-ee-private and gate behind feature = "private". OSS stubs
provide error messages when the feature is disabled.

Add an info Alert banner in the Registries settings section when no
enterprise license is active.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rubenfiszel

backend/Cargo.toml

@@ -96,7 +96,7 @@ lto = "thin"
 
 [features]
 default = []
-private = ["windmill-api/private", "windmill-api-agent-workers?/private", "windmill-autoscaling/private", "windmill-common/private", "windmill-git-sync/private", "windmill-indexer/private", "windmill-queue/private", "windmill-worker/private", "windmill-test-utils/private"]
+private = ["windmill-api/private", "windmill-api-agent-workers?/private", "windmill-autoscaling/private", "windmill-common/private", "windmill-git-sync/private", "windmill-indexer/private", "windmill-operator?/private", "windmill-queue/private", "windmill-worker/private", "windmill-test-utils/private"]
 agent_worker_server = ["windmill-api/agent_worker_server", "dep:windmill-api-agent-workers", "windmill-test-utils/agent_worker_server"]
 enterprise = ["windmill-worker/enterprise", "windmill-queue/enterprise", "windmill-api/enterprise", "windmill-api-agent-workers?/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise", "windmill-git-sync/enterprise", "windmill-common/prometheus", "windmill-common/enterprise"]
 local_reports = ["windmill-common/local_reports"]

backend/ee-repo-ref.txt

@@ -1 +1 @@
-e7f80bca9320580e1cb96b4f4ca9942649abce7f
+c2f12c6989e9f069fd274085aefde29264f73c8c

backend/windmill-operator/src/crd.rs

@@ -1,13 +1,11 @@
-pub mod crd;
-pub mod db_sync;
-pub mod reconciler;
-pub mod resolve;
+#[cfg(feature = "private")]
+pub mod crd_ee;
+#[cfg(feature = "private")]
+pub mod db_sync_ee;
+#[cfg(feature = "private")]
+pub mod reconciler_ee;
+#[cfg(feature = "private")]
+pub mod resolve_ee;
 
-pub use reconciler::run;
-
-/// Print the CRD YAML definition to stdout.
-pub fn print_crd_yaml() {
-    use kube::CustomResourceExt;
-    let crd = crd::WindmillInstance::crd();
-    println!("{}", serde_yml::to_string(&crd).unwrap());
-}
+mod operator_oss;
+pub use operator_oss::*;

backend/windmill-operator/src/db_sync.rs

@@ -0,0 +1,19 @@
+#[cfg(feature = "private")]
+pub use crate::reconciler_ee::run;
+
+#[cfg(feature = "private")]
+pub fn print_crd_yaml() {
+    use kube::CustomResourceExt;
+    let crd = crate::crd_ee::WindmillInstance::crd();
+    println!("{}", serde_yml::to_string(&crd).unwrap());
+}
+
+#[cfg(not(feature = "private"))]
+pub async fn run(_db: sqlx::Pool<sqlx::Postgres>) -> anyhow::Result<()> {
+    anyhow::bail!("K8s operator is not available in this build")
+}
+
+#[cfg(not(feature = "private"))]
+pub fn print_crd_yaml() {
+    eprintln!("K8s operator CRD generation is not available in this build");
+}