fix(worker-init): restore ESS configuration in released images

Description

Track the ordered delivery of a fix for secret-bearing function deployments.

The worker-init OCI image contains the worker-init binary but does not contain
the ESS configuration files that the binary reads from /etc/ess. When a
function has secrets, worker-init enters the ESS setup path and cannot prepare
the shared ESS configuration. Functions without secrets are unaffected.

This tracking issue covers the source fix, image release, chart consumption,
stack consumption, and end-to-end validation. Each phase depends on the
published artifact from the preceding phase.

Ordered phases

• #406 - Phase 1: Package ESS configuration in the worker-init OCI image and publish a fixed worker-init release.
• #408 - Phase 2: Update and publish the API chart with the fixed worker-init image.
• #407 - Phase 3: Consume the minimal API chart patch on the 0.6 release line.
• #405 - Phase 4: Consume the API chart on the main stack line and validate secret-bearing deployments.

Definition of Done

• The worker-init image contains:
  • /etc/ess/config.hcl
  • /etc/ess/secrets.tmpl
  • /etc/ess/accounts-secrets.tmpl
• An automated test fails if any required ESS image file is absent.
• The API chart references the fixed worker-init image.
• Both the 0.6 release line and main stack line reference the fixed API chart.
• A secret-bearing container function and Helm-chart function both deploy and
  reach an active state.
• Existing secrets-less deployment coverage continues to pass.

Resources

• Worker-init source: src/compute-plane-services/worker-init
• Main stack declaration: deploy/stacks/self-managed/helmfile.d/02-core.yaml.gotmpl

By submitting this issue, you acknowledge that you are an assigned member of the
NVCF development team and agree
to follow our code of conduct and our
contributing guidelines.

Start with the ordered phase issues #408, #407, and #405, then inspect src/compute-plane-services/worker-init and deploy/stacks/self-managed/helmfile.d/02-core.yaml.gotmpl. Verify the published worker-init image, chart references, release-line consumption, and deployment validation against the Definition of Done.