feat: add generic-app chart + CI to helm-charts repo

[majidkhan07]

What this adds

The new ChainSafe/helm-charts repo with one reusable generic-app chart,
CI, and automated publishing to a GitHub Pages Helm repo. This is Stage A of
the GitOps overhaul — the charts must exist and be proven before the ArgoCD
restructure (Stage B) consumes them.

generic-app design

• Verbatim splice: one template per Kubernetes kind; each kind is a map keyed
  by object name and its spec/data is spliced verbatim (toYaml). No
  service-specific logic in the chart — a service is described entirely by values.
• Off by default: every object renders only when enabled: true.
• Zero-diff by design: the chart injects no labels/names/defaults, so it can
  reproduce existing manifests byte-for-byte. It also expresses any field with no
  chart change.
• extraObjects escape hatch: any kind not modeled (Job, PDB, NetworkPolicy,
  Secret, Role, HPA, ServiceMonitor…) is rendered verbatim via a list.
• Kinds covered: Deployment, StatefulSet, Service, ServiceAccount, Ingress,
  ConfigMap, ExternalSecret, SecretStore, PersistentVolumeClaim, CronJob, plus
  extraObjects. Config-file injection via dataFiles/templateFiles.

CI / tooling

• helm-checks (PR): pre-commit, ct lint, helm-unittest, kubeconform,
  Conventional-Commit check (cz check).
• trivy (push + PR): fs scan, misconfig + secrets, renders the chart via
  TRIVY_HELM_VALUES, fails on HIGH/CRITICAL.
• chart-releaser (push to main): packages + publishes new chart versions to
  GitHub Pages (chainsafe.github.io/helm-charts).
• All actions pinned by commit SHA; pre-commit (helm-lint, helm-docs, commitizen,
  helm-unittest); CODEOWNERS → @ChainSafe/devops.

Verification

• helm lint clean; default render = 0 objects (off-by-default); 13 unit tests
  pass; kubeconform-valid; Trivy clean on HIGH/CRITICAL.

Repo setup required before first publish

• Make the repo public
• Grant the devops team write access to this repo (CODEOWNERS routing).
• Create the gh-pages branch up front — chart-releaser-action does not create
  it, and the first main push fails without it:

  git switch --orphan gh-pages && git commit --allow-empty -m "chore: init gh-pages" && git push origin gh-pages && git switch main

• Settings → Pages → deploy from the gh-pages branch.
• Workflow permissions can stay at the default Read — the release job declares
  permissions: contents: write itself.