Add a templated Helm chart under helm/ for deploying Logflare to
Kubernetes, along with a GitHub Actions workflow that gates chart
changes on pull requests.

The workflow runs only on PRs that touch helm/**, and it:
- installs Helm and the helm-unittest plugin
- lints the chart
- runs the chart unit tests
- renders the chart with default values via helm template
- verifies the chart version in Chart.yaml has been bumped above main

#3736)

* feat(helm): support custom vm.args via RELEASE_VM_ARGS

Adds an opt-in `vmArgs` value rendered into a ConfigMap, mounted at
/etc/logflare/vm.args, and wired via RELEASE_VM_ARGS. Defaults to a set
including `+Q 1048576`, which caps the BEAM's preallocated port table — needed
on Kubernetes, where containerd runs pods with nofile=infinity and the VM would
otherwise size the table from that (~2GB RSS at boot).

Mounted with subPath so it coexists with the cert-files mount under
/etc/logflare. A checksum/vm-args pod annotation rolls the Deployment when the
args change. Set vmArgs to "" to fall back to the image's baked-in vm.args.
Adds helm-unittest coverage.

* feat(helm): replace Stakater-specific reloader toggle with generic deploymentAnnotations

Per review on #3728: the `logflare.reloader` boolean hard-coded a Stakater-
specific annotation, which is too opinionated for a public chart. Replace it
with a generic top-level `deploymentAnnotations` map (mirroring podAnnotations)
that renders onto the Deployment's own metadata.annotations.

This keeps the chart neutral about the reload mechanism — opt into Reloader with
`deploymentAnnotations: { reloader.stakater.com/auto: "true" }` — and fills a
real gap: there was no hook for Deployment-level annotations (podAnnotations
only reaches the pod template). Updates the helm-unittest cases and README.

Render ExternalSecret resources directly from the chart when
externalSecrets.enabled is true, so ESO users can sync secrets without
hand-writing the ExternalSecrets. Off by default, so the chart still
renders no Secret and takes no dependency on ESO CRDs for anyone who
does not use it.

The (Cluster)SecretStore name/kind and every remote path live under a
single externalSecrets block in values. Each entry maps keys to
data[].remoteRef (secretKey is the key, remoteRef.key is
remotePrefix/key), with verbatim data/dataFrom passthrough for cases
keys cannot express. The block is ESO-specific by design, leaving room
for sibling provider blocks (e.g. Vault) later.

Adds helm-unittest coverage and README docs, and bumps the chart to
0.2.0.

Co-authored-by: depthfirst-app[bot] <184448029+depthfirst-app[bot]@users.noreply.github.com>

List every template deployment.yaml includes in each suite's templates
key, so helm-unittest compiles configmap.yaml and vm-args-configmap.yaml
and the checksum includes resolve instead of erroring.

Rewrite the cert-file volume and mount assertions to use
contains/notContains keyed on the volume name rather than a fixed [0]
index, since vmArgs is enabled by default and its vm-args volume now
occupies index 0.