Make ToSystemAffinity deterministic by sorting MatchLabels keys

[Copilot]

Thank you for contributing to Velero!

Please add a summary of your change

ToSystemAffinity() iterated LoadAffinity.NodeSelector.MatchLabels directly. Since it's a Go map, iteration order is nondeterministic, so the generated NodeSelectorRequirement slice could come out in different orders across calls. When the resulting affinity is embedded into continuously reconciled objects (e.g. node-agent DaemonSet pod templates), an order-only diff is treated as a spec change and triggers spurious rollouts/restarts.

Changes:

• Deterministic ordering — collect MatchLabels keys, sort.Strings them, then build requirements in sorted order. MatchExpressions ordering is already caller-defined.
• Rationale comment — documents that the output may feed objects reconciled in a loop where order-only churn causes restarts, so callers no longer need to sort the result themselves.
• Test — added a TestToSystemAffinity case with multiple match labels asserting sorted-by-key output.
• Callers verified — pkg/exposer/{generic_restore,csi_snapshot,pod_volume}.go and pkg/repository/maintenance/maintenance.go only assign the result into a Pod/Job spec; none depend on ordering.

keys := make([]string, 0, len(loadAffinity.NodeSelector.MatchLabels))
for k := range loadAffinity.NodeSelector.MatchLabels {
	keys = append(keys, k)
}
sort.Strings(keys)

for _, k := range keys {
	v := loadAffinity.NodeSelector.MatchLabels[k]
	requirements = append(requirements, corev1api.NodeSelectorRequirement{
		Key:      k,
		Values:   []string{v},
		Operator: corev1api.NodeSelectorOpIn,
	})
}

Does your change fix a particular issue?

Please indicate you've done the following:

• Accepted the DCO. Commits without the DCO will delay acceptance.
• Created a changelog file (make new-changelog) or comment /kind changelog-not-required on this PR.
• Updated the corresponding documentation in site/content/docs/main.

[netlify]

✅ Deploy Preview for velero canceled.

Name	Link
🔨 Latest commit	323900a
🔍 Latest deploy log	https://app.netlify.com/projects/velero/deploys/6a288fcd295ae60008fd0e00

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Lyndon-Li]

I think you could instead sort the final requirements, which looks more clear in the code