feat(helm): add chart release pipeline and modernize chart

[paulojmdias]

Closes #645

Summary

Adds an automated Helm chart release pipeline and modernizes the existing
deploy/k8s/helm-charts/promxy chart. Charts are published on every tag
push to both a classic Helm repo (gh-pages) and OCI (oci://ghcr.io/<owner>/helm-charts/promxy).

Release pipeline

• .github/workflows/helm-release.yaml — chart-releaser + GHCR OCI push
• .github/workflows/helm-ci.yaml — ct lint + ct install on kind across
  multiple values scenarios (ci/*-values.yaml)
• .github/workflows/helm-docs.yaml — enforces README.md is up to date
  (losisin/helm-docs-github-action@v1, version: v1.11.0, fail-on-diff: true)
• .github/ct.yaml — chart-testing config

Pre-merge prerequisites for maintainers

1. Create an empty gh-pages branch:

   git checkout --orphan gh-pages && git rm -rf . \
     && git commit --allow-empty -m "init gh-pages" \
     && git push origin gh-pages

2. In Settings → Actions → General, set workflow permissions to
   "Read and write permissions". No new repo secrets are required;
   GITHUB_TOKEN covers Releases and GHCR.

Chart modernization

• Bumped API versions: PDB→policy/v1, HPA→autoscaling/v2, VPA→autoscaling.k8s.io/v1
• kubeVersion: ">= 1.25.0-0", appVersion: "v0.0.93", chart version: 0.1.0
• New: podSecurityContext, container securityContext, priorityClassName,
  topologySpreadConstraints, extraVolumes/extraVolumeMounts,
  extraEnvFrom, configurable command, containerPort, probes
• Split extraArgs (map --key=value) and extraFlags (list --flag)
• image.tag: "" falls back to Chart.AppVersion
• configStorageType: ConfigMap|Secret — generated config can ship as a Secret
• .Values.config rendered through tpl so values can reference templates
• checksum/config pod annotation triggers redeploy on config changes
• revisionHistoryLimit configurable under deployment:
• configmap-reload sidecar bumped to v0.15.0 and made toggleable
• New templates/servicemonitor.yaml (Prometheus Operator, default off)
• New templates/route.yaml (Gateway API HTTPRoute v1beta1, multi-route)
• New templates/NOTES.txt
• Rename templates/configmap.yaml → templates/config.yaml
• Artifact Hub annotations (artifacthub.io/license: MIT, artifacthub.io/links)

Documentation

• New README.md.gotmpl with Artifact Hub + license badges
• Regenerated README.md via helm-docs v1.11.0
• All values documented with # -- helm-docs comments

Validation

• helm lint clean
• helm template validated across 6 scenarios:
  ci/{default,custom-port,full,ingress,scaling,secret}-values.yaml
• HTTPRoute renders correctly with default backend port

Backwards compatibility

No breaking changes to existing values keys (service.servicePort,
config, extraArgs, etc. remain). The image.tag default changes from
the previously hard-coded value to Chart.AppVersion fallback — users
pinning a tag explicitly are unaffected.