mecak8s chart: close invalid rendering states and scope local Redis resources

Problem

Several invalid or collision-prone value combinations pass Helm schema/template validation:

• Local Redis can render --redis-url="".
• Local Redis Service and StatefulSet names are hard-coded as redis, colliding across releases.
• A ClusterIP Service can render explicit nodePort fields.
• Invalid image digests and Kubernetes fullnameOverride values are accepted.
• Redis URL syntax and learning-store ports above 65535 render successfully but fail at runtime.
• Extra volumes/mounts can collide with chart-owned names such as tmp.

Proposed direction

Make local Redis release-scoped and derive its endpoint from the helper-generated Service name. Tighten JSON Schema and template-side cross-field validation for Kubernetes names, OCI digests, host/port syntax, Service type/nodePort combinations, and reserved resource names.

Acceptance criteria

• Local mode always renders a usable release-scoped Redis endpoint.
• Multiple local releases can coexist in one namespace.
• Every listed invalid value fails before manifests reach the API server or process startup.
• Negative render tests pin each rejected case.
• The local Redis image is configurable and can be digest-pinned.

Start by locating the Helm chart's JSON Schema, templates, helper-generated Service naming, and existing render-test harness. Add negative render coverage for each listed invalid combination and verify that local Redis uses a release-scoped endpoint, supports configurable digest-pinned images, and allows multiple releases to coexist.