feat(helm): add PodDisruptionBudget for controller and UI

[anthonyhaussman]

What

Adds an opt-in PodDisruptionBudget for the controller and UI Deployments, configured per component via controller.pdb and ui.pdb.

controller:
  pdb:
    enabled: false
    minAvailable: null
    maxUnavailable: 1
    unhealthyPodEvictionPolicy: ""
    labels: {}
    annotations: {}

Why these defaults

Disabled by default. Both components default to replicas: 1, and a minAvailable: 1 budget on a single-replica Deployment refuses every voluntary eviction, so node drains and cluster upgrades hang. When enabled, the default is maxUnavailable: 1, which is safe at any replica count.

NOTES.txt warns at install time when minAvailable >= replicas, the configuration that deadlocks drains.

Selector correctness

The budget selector is rendered from kagent.<component>.selectorLabels, the same helper the Deployment spec.selector already uses. A budget whose selector does not match the Deployment silently protects nothing, so reusing the helper makes drift impossible rather than merely unlikely.

Validation

Kubernetes rejects a PDB with both minAvailable and maxUnavailable, and one with neither is meaningless. Both cases now fail at template time with a message naming the offending values path:

Error: execution error at (kagent/templates/ui-pdb.yaml:2:4): ui.pdb: minAvailable and
maxUnavailable are mutually exclusive. Set exactly one (to use minAvailable, set
ui.pdb.maxUnavailable=null).

The set/unset check uses kindIs "invalid" rather than default "", because Helm treats 0 as empty and would otherwise silently drop a maxUnavailable: 0 budget.