[FEATURE] Generate per-stage Helm charts and an install chart from the rendered release #3682

A generator turns each upgrade-stage base of the release layout into a Helm chart, and adds an agent-substrate chart that depends on every stage chart for fresh installs. Helm is a release artifact, not a second hand-maintained copy of the install.

Tracks "Generate the charts from the rendered install" in the Helm Charts workstream of the Extensible Install Roadmap.

Required changes

• One agent-substrate-<stage> chart per stage in [FEATURE] Release Layouts #3176, plus agent-substrate (umbrella, fresh install).
• Substitute each documented setting ([FEATURE] Establish cluster-side install setting records #3172) with the template value named in the Helm values contract ([FEATURE] Base Helm Values for Installers #3186):
  • registries and mirrors;
  • external Postgres and object storage;
  • token issuers;
  • trust bundles and credential providers;
  • observability, sandbox assets, and component arguments.
• Add checksum/<object> pod-template annotations per [FEATURE] Settings change and removal mechanism #3663.
• No provider-specific values or conditionals.
• Decide whether generated charts are committed with a CI freshness check, or generated only in the release workflow.
• Build against the release layout sample ([FEATURE] Generate the release layout from ate-setup render #3678) until render exists.

Dependencies: #3186; #3678 sample; #3663.

Enforcement: a test renders each documented value and asserts it changes exactly its setting. helm template with default values matches the kustomize render apart from Helm labels.

Parent Issue: #3170