helm client-only --dry-run cannot validate the chart (lookup unavailable) - document --dry-run=server

Summary

Client-side helm upgrade --dry-run (no =server) does not evaluate lookup calls, so it produces misleading failures and cannot validate installs of this chart.

Observed with Helm v4 on this chart:

• The new namespace fail-guard (templates/guard-namespace.yaml, added in 71385aa) relies on lookup to detect an existing release-namespaced collision; under client-only dry-run the lookup returns nothing, so the guard's "already installed" behavior can't be tested.
• The priority-class templates (lookup "scheduling.k8s.io/v1" "PriorityClass" ...) fail under client-only dry-run with a false "not found/import" style error, even though the object exists in the cluster.
• helm upgrade --dry-run=server exits 0 and validates correctly.

Impact

Operators following "always dry-run first" may be blocked or misled. This is not a chart bug per se, but a Helm semantics gotcha that should be documented.

Suggested fix

Document in README / deploy runbooks:

• Use helm upgrade --dry-run=server (or plain helm upgrade) for pre-flight validation of this chart; client-only --dry-run cannot resolve lookup and will show spurious PriorityClass/guard errors.
• Optionally, the chart could warn when rendered under client-only dry-run, but detecting that in-template is not reliable.

Start with the README and deploy runbooks, then review the documented Helm commands and the behavior described for templates/guard-namespace.yaml and the PriorityClass lookups. Document that client-only --dry-run cannot resolve lookup and that --dry-run=server should be used for validation. Verify the guidance with helm upgrade --dry-run=server and the client-only command.