mecak8s chart: close remaining production operational hardening gaps

Problem

Several remaining operational hardening requirements are implicit or external:

• Environment-backed provider, learning-store, and MCP Secrets do not rotate in running pods and do not trigger rollouts.
• Offline/GitOps rendering generates a random telemetry installation UUID, producing perpetual diffs unless operators set it explicitly.
• Chart.yaml declares no supported kubeVersion, despite version-sensitive fields and policy/v1 resources.
• The raw-driver NetworkPolicy is namespace-global and trusts spoofable component labels rather than a strong workload identity.
• The chart lacks standard release metadata/labels and packages development test fixtures.

Proposed direction

Make the operator contracts explicit and machine-checkable where possible: provide credential rotation/rollout integration, deterministic GitOps identity, a tested Kubernetes version range, release-scoped policy selectors plus documented admission/namespace requirements, and conventional Helm metadata/packaging hygiene.

Acceptance criteria

• Every environment-backed Secret has a documented and tested rotation path.
• Identical offline renders are deterministic or fail with an actionable requirement.
• Supported Kubernetes versions are declared and tested in CI.
• Installing/uninstalling one release does not change another release's raw-driver policy.
• Security documentation does not present label selection alone as a tenant identity boundary.
• Published chart metadata reports the application version and excludes development-only files.

Start by inspecting the mecak8s chart, Chart.yaml, Secret and rollout templates, raw-driver NetworkPolicy, security documentation, CI checks, and packaged chart contents. Verify current offline renders and release interactions before defining changes. Done means rotation paths are tested, renders are deterministic or actionable, Kubernetes support is tested, policies are release-scoped, identity assumptions are documented, and published metadata and packaging are clean.