Add checksum/config annotation to template-chart and make it binding

A changed ConfigMap did not restart any pod in this repo: no chart carries
a checksum/config annotation, so the pod template stays identical and the
running container keeps its old config. With subPath mounts (the usual form
here) the kubelet never refreshes the file either, so the change is silently
ineffective - see #82, where this caused a real outage while every bundle was
green and the pod Ready.

template-chart is the reference implementation, so it gets the annotation on
both pod templates (Deployment and StatefulSet), and the README style guide
gets a new binding section 9 covering the rule, the reason, and the limit for
1Password-backed Secrets.

Major bump: runtime behavior changes - a config change now costs a restart.

template-chart/Chart.yaml

@@ -5,7 +5,7 @@ icon: https://helm.sh/img/helm.svg
 
 type: application
 
-version: 1.0.0+upxxx
+version: 2.0.0+upxxx
 appVersion: "xxx"
 
 maintainers:

template-chart/templates/xxx.deployment.yaml

@@ -14,6 +14,13 @@ spec:
       name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
       labels:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
+      annotations:
+        # Hash of the rendered ConfigMap: a changed ConfigMap changes the pod
+        # template and thus rolls the pods. Without it a config change stays
+        # invisible to the running container - subPath mounts are never
+        # updated by the kubelet, and most apps read their config only at
+        # start. Add one line per ConfigMap the workload consumes.
+        checksum/config: {{ include (print $.Template.BasePath "/xxx.configmap.yaml") . | sha256sum }}
     spec:
       automountServiceAccountToken: false
       securityContext:

template-chart/templates/xxx.sfs.yaml

@@ -15,6 +15,13 @@ spec:
       name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
       labels:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+      annotations:
+        # Hash of the rendered ConfigMap: a changed ConfigMap changes the pod
+        # template and thus restarts the pods. Without it a config change stays
+        # invisible to the running container - subPath mounts are never
+        # updated by the kubelet, and most apps read their config only at
+        # start. Add one line per ConfigMap the workload consumes.
+        checksum/config: {{ include (print $.Template.BasePath "/xxx.configmap.yaml") . | sha256sum }}
     spec:
       automountServiceAccountToken: false
       securityContext: