values.schema.json is strict at the root only, so nested typos validate silently

`charts/pangolin/values.schema.json` sets `additionalProperties: false` at the root only. Every object node below that accepts arbitrary keys, so a typo one level down validates silently and the setting is simply never applied.

```
helm template p charts/pangolin --set pangolin.config.serverr.trust_proxy=2
# renders successfully; the misspelled key is accepted and ignored
```

This compounds with an upstream property: Pangolin's config schema (`server/lib/readConfigFile.ts`) is a zod object that is **not** `.strict()`, so unknown keys the chart writes into `config.yml` are dropped without error there too. A misspelling therefore passes chart validation, passes Pangolin's own parsing, and produces a running deployment configured differently from what the operator wrote.

The same is true of `charts/newt/values.schema.json`.

## Why this is not a one-line fix

The schema is generated by the `helm schema` plugin from `@schema` annotations in `values.yaml`. Tightening it means either annotating every object node or changing the generator config, and doing that in one pass would reject values files that are valid today — including, potentially, the sibling `values.default.yaml` / `values.fulldev.yaml` and user files in the wild. It wants to be staged:

1. Tighten the branches operators touch most first — `pangolin.config.*`, `networkPolicy.*`, `newtInstances[]`.
2. Regenerate and render every file in `examples/`, `tests/values/` and `ci/` to find what the tightening rejects.
3. Note it in the CHANGELOG, since a previously-accepted values file may start failing — which is the point, but it should not be a surprise.

## Priority

P2, and worth doing before a wider release: the failure mode is a chart that installs cleanly and behaves differently from its values file, with nothing anywhere reporting a problem.

Start with charts/pangolin/values.schema.json, charts/newt/values.schema.json, and the @schema annotations in the corresponding values.yaml files. Run helm template with the misspelled key, then inspect the helm schema generator configuration and regenerate the schemas. Render the files in examples/, tests/values/, and ci/; done means targeted nested objects reject unknown keys without breaking valid fixtures, with the compatibility change recorded in the CHANGELOG.

Written by the indexing model from the issue text.