split CG service into internal headless and external service

[catpineapple]

For DDC ComputeGroups, separate the single service into two:

• Internal headless service (original name) for cluster communication and StatefulSet DNS-based pod discovery
• External service (with -external suffix) for load-balanced access

This enables smooth operator upgrades: users pre-create the external service, switch upstream traffic, then upgrade the operator. The reconcile logic handles the ClusterIP-to-headless migration by detecting and recreating the service when needed.

What problem does this PR solve?

Issue Number: close #xxx

Related PR: #xxx

Problem Summary:

Release note

None

Check List (For Author)

• Test

  • Regression test
  • Unit Test
  • Manual test (add detailed scripts or steps below)
  • No need to test or manual test. Explain why:
    • This is a refactor/code format and no logic has been changed.
    • Previous test can cover this change.
    • No code files have been changed.
    • Other reason

• Behavior changed:

  • No.
  • Yes.

• Does this need documentation?

  • No.
  • Yes.

Check List (For Reviewer who merge this PR)

• Confirm the release note
• Confirm test cases
• Confirm document
• Add branch pick label