docs(engine/helm): correct cidrContains docstring on operator-typo path

Previous wording claimed an operator-typoed floatingIP would fall
through cidrContains to the default-route fallback link "rather
than failing the render". That stopped being true once the chart
layer added ipIsValid fail-fast for floatingIP — a typo now
aborts the render at template time with a clear hint, never
reaching cidrContains.

Rewrite the paragraph so a reader looking at cidrContains
understands the actual flow: lenient on COSI iteration (a corrupt
entry mustn't crash the render) but the operator's floatingIP is
validated up-front by ipIsValid, so a typo is caught before
cidrContains is invoked.

Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

pkg/engine/helm/engine.go

@@ -333,10 +333,10 @@ func ipIsValid(addrStr string) (string, error) {
 // undefined IP is not in any defined set. The chart-side helper that drives
 // the membership search runs over every entry in the addresses COSI
 // resource, so a single corrupt or future-format entry must not crash the
-// entire render. An operator-typoed floatingIP likewise falls through to the
-// default-route fallback link rather than failing the render — Talos itself
-// rejects malformed IP literals with a clear error on apply, so the chart
-// layer does not need to duplicate that check.
+// entire render. The operator-typoed floatingIP case is handled separately
+// by the chart layer: cozystack and generic call ipIsValid up-front and
+// fail the render with a clear hint that names the bad value, so a typoed
+// floatingIP never reaches cidrContains.
 func cidrContains(cidr, addrStr string) (bool, error) {
 	prefix, err := netip.ParsePrefix(cidr)
 	if err != nil {