ci: guard resource quantities against exponential notation

Adds ci/run-quantity-render-test.sh and a validate-charts job that runs it
over every chart on every PR.

The bug behind #157 has a loud and a silent half. Loud: a bare integer request
of 1048576 is reformatted by printf "%v" to "1.048576e+06", the helper rejects
the suffix it produced itself and the render aborts. Silent: with a fractional
limitFactor the *product* is reformatted after the suffix check, the render
succeeds, and the manifest carries memory: "1.4999985e+06" - rejected by
nothing until the API server sees it at apply time.

So the test renders each chart twice and, for the silent case, searches the
rendered text rather than the exit code. It runs over all charts, not the
changed ones: the resources helper is copied into every chart's _helpers.tpl,
so the regression arrives by copy, in a PR whose diff shows a new chart and not
the bug inside it. The resources paths come from values.schema.json (JSON, so
python3 reads it without pyyaml), which also means a new chart is enrolled
automatically and there is no list to maintain.

Charts that pin every computable limit in their fallback defaults never reach
the helper (gotenberg, rss-bridge). They are reported as "not exercised"
instead of counted as passing.

.github/workflows/validate-charts.yml

@@ -89,6 +89,29 @@ jobs:
             echo "Version bump OK: $BASE_VERSION -> $NEW_VERSION"
           fi
 
+  quantity-render:
+    name: "Resource quantities"
+    runs-on: ubuntu-latest
+    # The one job in this workflow that deliberately ignores the changed-chart
+    # matrix and runs over *every* chart (issue #157). The bug it guards
+    # against - resource quantities formatted with printf "%v", where float64
+    # flips to exponential notation above ~1e6 - lives in the resources helper,
+    # and that helper is copied into every chart's templates/_helpers.tpl,
+    # because charts here have no dependencies. So it comes back by copy: a new
+    # chart started from an older one, or from template-chart before the fix.
+    # In that PR the chart is new and its copy of the bug is in no diff anyone
+    # reads. Running over everything also means there is no list to maintain -
+    # adding a chart enrolls it. Two renders per chart, no cluster, a few
+    # seconds in total; it depends on no other job and finishes long before
+    # build-chart, so it adds no wall-clock time to the pipeline.
+    steps:
+      - name: "Checkout Repository"
+        uses: actions/checkout@v7
+      - name: "Install Helm"
+        uses: azure/setup-helm@v5
+      - name: "Render every chart with bare integer quantities"
+        run: ci/run-quantity-render-test.sh
+
   trivy-config:
     name: "Trivy config ${{ matrix.chart }}"
     needs: detect-changed-charts