[FEATURE] Separate agent-substrate-crds chart #3684

Helm never upgrades CRDs in a chart's crds/ directory. Ship the CRDs as templates in an agent-substrate-crds chart with helm.sh/resource-policy: keep.

Tracks "Publish a separate CRD chart" in the Helm Charts workstream of the Extensible Install Roadmap.

Required changes

• Generate agent-substrate-crds from release/crds/.
• On a fresh install it is installed first. On upgrade it is upgraded at the version skew policy's CRD step (just before 5-controller), not first.
• Document both orders.

Dependencies: #3678.

Enforcement: chart CI (#3687) upgrades CRDs at the CRD step, and uninstalling the chart leaves the CRDs.

Parent Issue: #3170