Epic: Beta release readiness

Tracks the work to promote this pack from experimental to beta per the release readiness checklist.

Beta requires every [E], [A], and [B] item to pass. Levels are sequential, so this is two promotion PRs: experimental to alpha (pack owner + pre-sales rep), then alpha to beta (pack owner + pre-sales rep + tech lead).

Audit summary (2026-06-11)

Already passing:

• helm lint runs in CI on every push/PR
• Release workflow works; 16 alpha releases published
• pack-metadata.yaml validates against the dashboard schema; pack is listed in tracked-packs.yaml
• All images pinned to SHA or explicit tags, no latest; GitHub Actions SHA-pinned
• No hardcoded secrets; everything flows through secretKeyRef / operator-provisioned secrets
• OIDC scopes are minimal (openid profile email groups, all used)
• Health probes via z2jh subchart defaults plus the NebariApp landingPage healthCheck
• Test coverage is well past the beta bar: unit tests against real jupyterhub/oauthenticator, matrix-per-test e2e on kind, Keycloak integration tests against a live NIC sandbox

Gaps are tracked in the sub-issues attached to this epic. Roughly in order: metadata and CODEOWNERS, Chart.yaml appVersion, CI additions, README sections, examples, telemetry, security justifications, helm repo publishing, and the runtime verification + sign-off items that close out the promotion PRs.

Start with docs/release-readiness-checklist.md and review the attached sub-issues, since the remaining gaps cover metadata, Chart.yaml, CI, README sections, examples, telemetry, security, publishing, and runtime sign-off. Map each [E], [A], and [B] item to its sub-issue; done means every required item passes and the two promotion PRs receive the stated approvals.