satisfactory: strict values.schema.json and null-safe hardening

No ingress gate: this chart has no Ingress at all (game and messaging
ports are exposed via NodePort), and ingress.domain appears neither in
its templates nor in its values.

1. values.schema.json (#68): additionalProperties: false on every
   chart-owned object level. Like teamspeak-server, this chart keeps env,
   probes and securityContext at the TOP level, and the schema mirrors
   that shape.

2. Null-safety for hardening, probes and resources (#99). What a rebuilt
   default must not lose here:
   - liveness and startup run the image's own healthcheck script via
     exec. It queries the server's HTTPS API on SERVERGAMEPORT, so it
     survives a port override, which a tcpSocket default could not.
   - readiness keeps the named "api" port.
   - the resources default keeps limitFactor 2 rather than the repo-wide
     3, which is what holds the memory limit at the published 8Gi.
   - the pod context keeps fsGroupChangePolicy OnRootMismatch, which is
     what avoids a recursive chown of multi-GB game files on every start.

server.storage stays deliberately not null-safe: an erased value yields
an invalid PVC, which is the loud class #99 excludes.

This chart is excluded from the CI install-test, so the local proof is
the only one. Rendering is byte-identical to 4.0.0 with default values
and with the production bundle values, and the rendered manifests were
additionally validated by the cluster's API server via a server-side
dry-run.

satisfactory/templates/satisfactory.sfs.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.securityContext.pod | nindent 8 }}
+        {{- include "satisfactory.podSecurityContext" .Values.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
           image: "ghcr.io/wolveix/satisfactory-server:{{ .Chart.AppVersion }}"
@@ -73,13 +73,13 @@ spec:
               containerPort: {{ .Values.server.messagingPort }}
               protocol: TCP
           livenessProbe:
-            {{- toYaml .Values.livenessProbe | nindent 12 }}
+            {{- include "satisfactory.livenessProbe" .Values.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.readinessProbe | nindent 12 }}
+            {{- include "satisfactory.readinessProbe" .Values.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.startupProbe | nindent 12 }}
+            {{- include "satisfactory.startupProbe" .Values.startupProbe | nindent 12 }}
           resources:
-            {{- include "satisfactory.resources" .Values.server.resources | nindent 12 }}
+            {{- include "satisfactory.effectiveResources" .Values.server.resources | nindent 12 }}
           volumeMounts:
             - name: satisfactory-volume
               mountPath: /config
@@ -104,7 +104,7 @@ spec:
             - name: tmp
               mountPath: /tmp
           securityContext:
-            {{- toYaml .Values.securityContext.container | nindent 12 }}
+            {{- include "satisfactory.containerSecurityContext" .Values.securityContext | nindent 12 }}
       volumes:
         - name: satisfactory-volume
           persistentVolumeClaim: