homeassistant: strict values.schema.json and null-safe hardening

No ingress gate change: this chart already honours ingress.enabled, and
its ingress block keeps the upstream-style host/tls lists that the README
documents as an exception. The schema models that shape as it is instead
of pushing the repo's domain/clusterIssuer pair onto it, and the list
entries stay open because they go verbatim into the Ingress spec.

The domain checkpoint ran over values.yaml and templates and came back
empty: ingress.domain does not exist in this chart at all.

1. values.schema.json (#68): additionalProperties: false on every
   chart-owned object level. Pod-spec passthrough (volumes, volumeMounts,
   nodeSelector, tolerations, affinity, ingress hosts/tls) stays open.

2. Null-safety for hardening, probes and resources (#99).

   This chart's hardening is a documented deviation and the fallbacks
   reproduce it exactly: the pod context is deliberately EMPTY, because
   the official image must start as root (s6-overlay does its setup as
   uid 0 and the image has no non-root user), and capabilities.add keeps
   NET_RAW, without which device discovery (DHCP watcher, ping/arp
   integrations) logs "Operation not permitted".

core.storage stays deliberately not null-safe: an erased block yields an
invalid PVC, which is the loud class #99 excludes.

The #82 limitation around the 1Password-backed config Secret is
untouched: Helm never sees the content, so it cannot be hashed, and the
values.yaml note about the manual rollout restart stays as it is.

Rendering with normal values is byte-identical to 5.0.0.

homeassistant/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy Home Assistant on Kubernetes
 icon: https://www.home-assistant.io/images/home-assistant-logo.svg
 type: application
 
-version: 5.0.0+up2026.8.3
+version: 6.0.0+up2026.8.3
 
 appVersion: "2026.8.3"