feat(helm): split gateway and workspace charts - #2643

Summary

Split the current OpenShell Helm deployment into independently installable gateway and workspace-resource charts. This enables one shared gateway deployment to manage sandbox resources provisioned separately in application or tenant namespaces while preserving the existing single-chart behavior by default.

Related Issue

Closes #2485

Changes

• Add an openshell-workspace chart for namespace-scoped sandbox RBAC, service accounts, and supporting resources.
• Add the backward-compatible workspaceResources.enabled switch to the existing gateway chart.
• Package and publish both charts through the existing release workflow.
• Add chart documentation, CI values, and Helm unit coverage for split deployments.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (not applicable; chart render behavior is covered by Helm unit tests)
• helm unittest deploy/helm/openshell (76 tests)
• helm unittest deploy/helm/openshell-workspace (4 tests)
• Helm lint and generated documentation checks for both charts

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)