feat(helm): split gateway and workspace charts

[dhirajsb]

Summary

Split the current OpenShell Helm deployment into independently installable gateway and workspace-resource charts. This enables one shared gateway deployment to manage sandbox resources provisioned separately in application or tenant namespaces while preserving the existing single-chart behavior by default.

Related Issue

Closes #2485

Changes

• Add an openshell-workspace chart for namespace-scoped sandbox RBAC, service accounts, and supporting resources.
• Add the backward-compatible workspaceResources.enabled switch to the existing gateway chart.
• Package and publish both charts through the existing release workflow.
• Add chart documentation, CI values, and Helm unit coverage for split deployments.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (not applicable; chart render behavior is covered by Helm unit tests)
• helm unittest deploy/helm/openshell (76 tests)
• helm unittest deploy/helm/openshell-workspace (4 tests)
• Helm lint and generated documentation checks for both charts

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.