chore(charts): add chart-testing (ct) CI for lint validation

[ferponse]

Summary

Adds automated linting and template/schema validation for the Helm charts on every PR that touches a chart, closing the gap that let issues like #1233, #1235, #1236 and #1240 through.

Closes #1254

What it does

.github/workflows/chart-testing.yml with two jobs:

1. ct lint — helm lint + yamllint over all three charts, run for the default values and each ci/*-values.yaml value set.
2. kubeconform — renders every chart (default + each ci/ value set) and validates the produced manifests against explicit, pinned Kubernetes schema versions (1.21.1, 1.28.6, 1.34.2) — the charts' kubeVersion floor plus a mid and a recent release, mirroring kubernetes-test.yml.

Values matrix (the important part)

A single default-values render misses the conditional branches — which is exactly where the referenced regressions lived. Each chart ships a ci/ value set so those branches are the ones being linted and validated:

Chart	Value set	Exercises
opensandbox-server	ci/gateway-enabled-values.yaml	Full ingress-gateway block (SA, ClusterRole/Binding, Deployment, Service) + secure-access signing (#1233/#1235/#1236)
opensandbox-server	ci/volumes-and-env-values.yaml	Non-empty server.volumes/volumeMounts/env (#1240, non-empty side)
opensandbox-controller	ci/full-features-values.yaml	Non-empty extra volumes/mounts, sidecars, init containers, env, pull secrets, scheduling, snapshot secrets
opensandbox-controller	ci/minimal-values.yaml	Disabled SA/RBAC/CRDs/probes/leader-election
opensandbox	ci/full-values.yaml	Both sub-charts' optional branches together

Notes

• CustomResourceDefinition is skipped in kubeconform (the CRDs are static definitions and the default schema set carries no CRD meta-schema); the workload manifests stay -strict.
• --validate-maintainers=false / --check-version-increment=false on ct lint (team email, no per-PR version bump).
• Strips trailing whitespace from opensandbox-controller / opensandbox-server values.yaml, which yamllint (run by ct) flags.

Verified locally

• ct lint — all charts green, incl. every ci/ value set.
• kubeconform — green across all three Kubernetes versions × all charts × every value set.

[Pangjiping]

I don't think this is a regression worth this much investment.

The referenced issues (#1233 #1235 #1236 #1239 #1240) are all small oversights from the same round of ingress-gateway / values.yaml cleanup — similar pattern, cheap to fix. It's a stretch to frame them as "a class of issues that keeps leaking through." Standing up chart-testing + kubeconform + a per-chart ci/*-values.yaml matrix for this adds more toolchain and coverage-matrix complexity than the bugs it's meant to prevent.

More importantly, the maintenance ownership of multiple near-duplicate value files is unclear: when values.yaml gains a new field or a new conditional branch, who is responsible for keeping ci/gateway-enabled-values.yaml, ci/volumes-and-env-values.yaml, ci/full-features-values.yaml, ci/minimal-values.yaml, and ci/full-values.yaml in sync? Without an enforcement mechanism these value sets will silently rot over time — CI stays green while actual coverage drops. We end up not catching regressions and carrying a pile of YAML that has to be dragged along with every chart change.

Suggested minimal alternative: run helm lint + helm template | kubeconform against each of the three charts on PR CI, using only the default values (no ci/ sets). That alone would have caught the "renders malformed YAML" class of bugs like #1239 / #1240. If regressions inside conditional branches actually keep recurring later, we can add targeted value sets then — and codify the rule "changes to chart values must sync the corresponding ci/ set" in kubernetes/AGENTS.md at that point.