Partner license + activation via itl-install.yaml

[nielsweistra]

Activation flow: partner fills in license key in itl-install.yaml, the Talos bootstrap job calls back to the ITL control plane to activate the install and configure tenant isolation. Partner receives branded operator portal URL.