Fix: Prevent duplicate sidecars by using temp copies instead of sed -i

When SNAPSHOT_METADATA_TESTS=true or VOLUME_MODE_CONVERSION_TESTS=true,
the deploy script was modifying git-tracked YAML files in-place using
sed -i. This caused issues on subsequent runs:

- Run 1: Works fine, adds 1 snapshot-metadata sidecar
- Run 2: File already modified, adds another sidecar → duplicate containers
- Run 3+: More duplicates → Kubernetes rejects deployment

Root cause:
- Lines 257, 263-265 used sed -i to modify files directly
- Modified files were committed to git or left dirty
- Not idempotent - each run added more modifications

Solution:
- Copy files to TEMP_DIR before modifications
- Apply all sed operations to temporary copies
- Keep original git-tracked files pristine
- Script is now fully idempotent

Fixes the bug across all kubernetes-* deployments that use
deploy/util/deploy-hostpath.sh as a symlink.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: kaovilai

deploy/util/deploy-hostpath.sh

@@ -253,18 +253,23 @@ fi
 echo "deploying hostpath components"
 for i in $(ls ${BASE_DIR}/hostpath/*.yaml | sort); do
     echo "   $i"
+
+    # Copy original file to temp directory to avoid modifying git-tracked files
+    temp_yaml="${TEMP_DIR}/$(basename "$i")"
+    cp "$i" "$temp_yaml"
+
     if volume_mode_conversion; then
-      sed -i -e 's/# end csi-provisioner args/- \"--prevent-volume-mode-conversion=true\"\n            # end csi-provisioner args/' $i
+      sed -i -e 's/# end csi-provisioner args/- \"--prevent-volume-mode-conversion=true\"\n            # end csi-provisioner args/' "$temp_yaml"
     fi
 
     # Add external-snapshot-metadata sidecar to the driver, mount TLS certs,
     # and enable snapshot-metadata service
     if snapshot_metadata; then
-      sed -i -e "/# end csi containers/r ${SNAPSHOT_METADATA_SIDECAR_PATCH_RELATIVE_PATH}" $i
-      sed -i -e 's/# end csi volumes/- name: csi-snapshot-metadata-server-certs\n          secret:\n            secretName: csi-snapshot-metadata-certs\n        # end csi volumes/' $i
-      sed -i -e 's/# end hostpath args/- \"--enable-snapshot-metadata\"\n            # end hostpath args/' $i
+      sed -i -e "/# end csi containers/r ${SNAPSHOT_METADATA_SIDECAR_PATCH_RELATIVE_PATH}" "$temp_yaml"
+      sed -i -e 's/# end csi volumes/- name: csi-snapshot-metadata-server-certs\n          secret:\n            secretName: csi-snapshot-metadata-certs\n        # end csi volumes/' "$temp_yaml"
+      sed -i -e 's/# end hostpath args/- \"--enable-snapshot-metadata\"\n            # end hostpath args/' "$temp_yaml"
     fi
-    modified="$(cat "$i" | sed -e "s;${default_kubelet_data_dir}/;${KUBELET_DATA_DIR}/;" | while IFS= read -r line; do
+    modified="$(cat "$temp_yaml" | sed -e "s;${default_kubelet_data_dir}/;${KUBELET_DATA_DIR}/;" | while IFS= read -r line; do
         nocomments="$(echo "$line" | sed -e 's/ *#.*$//')"
         if echo "$nocomments" | grep -q '^[[:space:]]*image:[[:space:]]*'; then
             # Split 'image: quay.io/k8scsi/csi-attacher:v1.0.1'