Use `helm-unittest` to verify the rendered templates are as expected

We should use https://github.com/helm-unittest/helm-unittest to verify the rendered templates have the bits and bobs that we expect depending on the values set.

Rough plan is one suite per template (`*_test.yaml`), with the existing `ci/*-values.yaml` files reused as the value scenarios where they fit. Conventions can follow https://github.com/stacklok/toolhive/tree/main/deploy/charts/operator/tests.

Scenarios to cover:

Deployment
- [x] default render: one Deployment, correct name/labels, selector is a subset of pod labels (#353)
- [x] image registry/repo (tag-agnostic) and digest override pinning `@sha256:...` (#353)
- [x] static replicas present by default, gone when autoscaling is on (#353)
- [x] update strategy (#353)
- [x] liveness/readiness/startup probes when set, absent when disabled (#353)
- [x] appConfig mounted as a volume with the right `--config` arg (#353)
- [x] postgres creds wired from generated vs provided secret (#353)
- [x] extraEnvVars, extraVolumes/extraVolumeMounts (#353)
- [x] topologySpreadConstraints, nodeSelector/affinity/tolerations (#353)
- [x] pod and container securityContext (#353)
- [x] initContainers / extra containers (#353)

Service
- [x] default ClusterIP with correct port/targetPort/name (#353)
- [x] type override and nodePorts (#353)
- [x] dual-stack ipFamilies/ipFamilyPolicy (#353)
- [x] loadBalancerSourceRanges (regression for #333) (#353)
- [x] extraPorts and annotations (#353)

ServiceAccount
- [x] created when create=true, nothing rendered when false (#353)
- [x] name precedence, and the Deployment references the same name (#353)
- [x] annotations and automountServiceAccountToken (#353)

Ingress
- [x] disabled by default, renders when enabled (#353)
- [x] host/path/pathType, ingressClassName, TLS (#353)
- [x] extra hosts (#353)
- [x] annotations passthrough (#353)

HTTPRoute
- [x] disabled by default, renders when enabled (#353)
- [x] parentRefs/hostnames/rules, correct kind and apiVersion (#353)

HPA
- [x] disabled by default, renders when autoscaling is on (#353)
- [x] min/max replicas, CPU metric only when targetCPU set, memory only when targetMemory set (#353)
- [x] correct scaleTargetRef (#353)

PDB
- [x] disabled by default, renders when enabled (#353)
- [x] minAvailable xor maxUnavailable, correct selector (#353)

NetworkPolicy (ingress + egress)
- [x] disabled by default, renders when enabled (#353)
- [x] ingress/egress rules present when configured, egress on/off (#353)

ServiceMonitor
- [x] disabled by default, renders when enabled (#337)
- [x] correct kind/apiVersion, endpoint port/path/interval, selector labels (#337)

ConfigMap (app-config)
- [x] only renders when appConfig is set (#337)
- [x] data contains the rendered config (#337)

extraDeploy
- [x] arbitrary manifests render and templated strings get evaluated (#353)

Cross-cutting
- [x] fullnameOverride vs nameOverride precedence across resources (#353)
- [x] commonLabels/commonAnnotations propagate everywhere, clusterDomain substitution (#353)
- [x] negative tests with failedTemplate: PDB with both min/max, bad service.type, provided-creds missing secret name (#353)

Wiring
- [x] run helm-unittest via a pre-commit hook (#337)
- [x] run `helm unittest charts/backstage` in CI (#337)