prometheus.io/service-monitor: "false" on pyroscope-headless is an annotation, and it should be a label

#### Describe the bug

When `serviceMonitor.enabled: true`, the chart creates a ServiceMonitor that uses a `matchExpression` to exclude the headless service from scraping:

```yaml
matchExpressions:
- key: prometheus.io/service-monitor
operator: NotIn
values:
- "false"
```

Past 90eceaacd2935b8221dc5cba7e3f62021f9f948e that label got moved to annotations - and as a result, the exclusion no longer works. As a result both pyroscope and pyroscope-headless are scraped.

#### To Reproduce

1. Deploy Pyroscope 2.0.1 via Helm with `serviceMonitor.enabled: true`
2. Observe that a ServiceMonitor is created with a `matchExpression` excluding `prometheus.io/service-monitor: "false"`
3. Check the headless service - the value is under metadata.annotations, not metadata.labels
4. Query your metrics backend for up{job=~"pyroscope.*"} — both job="pyroscope" and job="pyroscope-headless" appear, pointing at the same pod IP

#### Expected behavior

The headless service should be excluded from ServiceMonitor discovery.