fix: bump deployment-operator chart to 0.6.41

[plural-copilot]

Summary

• bump the deployment-operator Helm chart version and appVersion to 0.6.41
• pin the default deployment-operator image tag to 0.6.41 so chart installs stop floating to the vulnerable 0.6.40 image
• align the chart with the patched deployment-operator image needed to remediate the containerd runAsNonRoot bypass finding

Test Plan

• bash -n test/helm/test-chart-install.sh
• attempted helm lint, helm template, and helm install --dry-run, but helm is not installed in this execution environment

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Security scanners have found the following vulnerability in our cluster:...
🔗 Run history	View run history

[greptile-apps]

Greptile Summary

This PR bumps the deployment-operator Helm chart to version 0.6.41 (both version and appVersion) and pins the default image tag to 0.6.41 in values.yaml to remediate a containerd runAsNonRoot bypass found in 0.6.40.

• Chart.yaml: version and appVersion both updated from 0.6.40 → 0.6.41.
• values.yaml: image.tag changed from "" to "0.6.41", pinning the image rather than relying on the chart's appVersion fallback; this diverges from the default .Chart.AppVersion convention used in the deployment template and will require dual-field updates on every future release.

Confidence Score: 4/5

Safe to merge — the version bump is correct and consistent, and the pinned tag matches appVersion today.

Both changed fields are currently in sync (chart version and pinned tag both read 0.6.41), so the chart will deploy the intended image. The concern is forward-looking: hardcoding image.tag in values.yaml bypasses the default .Chart.AppVersion logic in the deployment template, meaning the next release will need to remember to update both Chart.yaml and values.yaml or installs will silently pull the wrong image.

charts/deployment-operator/values.yaml — the hardcoded image tag diverges from the chart's own defaulting convention.

Important Files Changed

Filename	Overview
charts/deployment-operator/Chart.yaml	Bumps both version and appVersion from 0.6.40 to 0.6.41; straightforward and consistent.
charts/deployment-operator/values.yaml	Pins image.tag to "0.6.41"; diverges from the default .Chart.AppVersion convention used by the deployment template, creating a dual-maintenance burden for future releases.

_{Reviews (1): Last reviewed commit: "fix: bump deployment-operator chart to 0..." | Re-trigger Greptile}

[greptile-apps]

Hardcoding image.tag breaks the chart's own default mechanism. The deployment template resolves the tag as {{ .Values.image.tag | default .Chart.AppVersion }}, which means a non-empty tag always wins over appVersion. Future version bumps that only update Chart.yaml will still pull 0.6.41 instead of the new appVersion, causing silent version drift. The agentk.image.tag field keeps the empty-string convention for exactly this reason. The comment on the preceding line also becomes misleading since the tag no longer defaults to appVersion.

Suggested change

	# Overrides the image tag whose default is the chart appVersion.
	tag: ""
	tag: "0.6.41"
	# Overrides the image tag whose default is the chart appVersion.
	tag: ""