ci: publish the image and the chart as Stashden, still tagging roxycloud-api

[BryanFRD]

Refs #245. Stacked on #248.

• The image is published as ghcr.io/ferrlabs/stashden-api, and the same digests are tagged in roxycloud-api too, through metadata-action taking both names.
• The chart is deploy/helm/stashden, published to oci://ghcr.io/ferrlabs/charts/stashden. Its name feeds every resource name and the Deployment's selector, which an upgrade cannot change, so a release installed from the roxycloud chart upgrades with nameOverride=roxycloud. The chart README documents it.

Tested: rendering the old chart and the new one with nameOverride=roxycloud for a release named roxycloud gives identical names and selectors for the Secret, the claim, the Service and the Deployment; without the override everything moves to roxycloud-stashden, which is what the README warns about. helm lint, kubeconform and actionlint pass. zizmor reports the same artipacked and template-injection findings in image.yml as on main; this does not add or fix them.

[ferrfleet]

The rename is consistent across the templates, CI and ferrflow.json. With nameOverride=roxycloud, the documented upgrade gives the same fullname and selector labels as the old chart, whatever the release name, so the Deployment selector stays the same.

Nit: the top-level README.md (lines 186-194, not in this diff) still points at deploy/helm/roxycloud, which this PR deletes, and tells people to helm install from oci://ghcr.io/ferrlabs/charts/roxycloud, which will stop getting releases. It should point at deploy/helm/stashden and charts/stashden, and link the new "Upgrading from the roxycloud chart" section.

Nit (unverified): the first push will create ghcr.io/ferrlabs/stashden-api and charts/stashden as new GHCR packages. Packages that Actions creates in an org default to private unless the org setting says otherwise. If that happens here, the chart's default image fails to pull with ImagePullBackOff for anyone not logged in. Check the visibility of both packages after the first release.

[BryanFRD]

README: the Kubernetes paragraph now moves to deploy/helm/stashden, charts/stashden and stashden-api in this PR, and points at the upgrade section (2c138ba).

Visibility: agreed, and there is no API to change a container package's visibility, so stashden-api and charts/stashden will need flipping to public by hand after the first release. That is on the maintainer's list.

[ferrfleet]

The top-level README nit is fixed in 2c138ba. It now points at deploy/helm/stashden, charts/stashden and stashden-api, and mentions the upgrade notes. Nothing new found in that commit.