[arturre]

Description

This pull request changes the following:

• When the backup uploader is enabled, the operator now mounts the saved and stats volumes read-only at the paths backup.sh expects:
  • /opt/hgcapp/services-hedera/HapiApp2.0/data/saved
  • /opt/hgcapp/services-hedera/HapiApp2.0/data/stats
• additionalVolumeMounts are still appended. A mount with the same mountPath replaces the default, so existing manual workarounds keep working and don't fail with duplicate mount paths.
• backup.sh also uploads HapiApp2.0/VERSION. The operator now sets BACKUP_UPLOADER_CN_VERSION on the sidecar from the consensus node imageTag.

Follow-ups

• The new image includes fix(backup-uploader): write current-round marker outside / hiero-ledger/solo-containers#255. The backup-uploader root exception (runAsNonRoot=false) can then be replaced with runAsSecurityContext(HederaUID, HederaUID).

Related Issues

• Closes fix(consensus): backup-uploader has no default saved/stats/VERSION mounts #1431
• Depends on feat(backup-uploader): add BACKUP_UPLOADER_CN_VERSION env var hiero-ledger/solo-containers#257
• Found while reviewing feat(consensus): apply hardened securityContext defaults to cn pod #1426