homeassistant: strict values.schema.json and null-safe hardening

No ingress gate change: this chart already honours ingress.enabled, and
its ingress block keeps the upstream-style host/tls lists that the README
documents as an exception. The schema models that shape as it is instead
of pushing the repo's domain/clusterIssuer pair onto it, and the list
entries stay open because they go verbatim into the Ingress spec.

The domain checkpoint ran over values.yaml and templates and came back
empty: ingress.domain does not exist in this chart at all.

1. values.schema.json (#68): additionalProperties: false on every
   chart-owned object level. Pod-spec passthrough (volumes, volumeMounts,
   nodeSelector, tolerations, affinity, ingress hosts/tls) stays open.

2. Null-safety for hardening, probes and resources (#99).

   This chart's hardening is a documented deviation and the fallbacks
   reproduce it exactly: the pod context is deliberately EMPTY, because
   the official image must start as root (s6-overlay does its setup as
   uid 0 and the image has no non-root user), and capabilities.add keeps
   NET_RAW, without which device discovery (DHCP watcher, ping/arp
   integrations) logs "Operation not permitted".

core.storage stays deliberately not null-safe: an erased block yields an
invalid PVC, which is the loud class #99 excludes.

The #82 limitation around the 1Password-backed config Secret is
untouched: Helm never sees the content, so it cannot be hashed, and the
values.yaml note about the manual rollout restart stays as it is.

Rendering with normal values is byte-identical to 5.0.0.

homeassistant/templates/homeassistant.sfs.yaml

@@ -30,13 +30,13 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.securityContext.pod | nindent 8 }}
+        {{- include "homeassistant.podSecurityContext" .Values.securityContext | nindent 8 }}
       containers:
         - name: "{{ .Release.Name }}-{{ .Chart.Name }}"
           image: "ghcr.io/home-assistant/home-assistant:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
           securityContext:
-            {{- toYaml .Values.securityContext.container | nindent 12 }}
+            {{- include "homeassistant.containerSecurityContext" .Values.securityContext | nindent 12 }}
           env:
             - name: TZ
               value: "{{ .Values.core.timezone }}"
@@ -65,13 +65,13 @@ spec:
               containerPort: 8123
               protocol: TCP
           livenessProbe:
-            {{- toYaml .Values.livenessProbe | nindent 12 }}
+            {{- include "homeassistant.livenessProbe" .Values.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.readinessProbe | nindent 12 }}
+            {{- include "homeassistant.readinessProbe" .Values.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.startupProbe | nindent 12 }}
+            {{- include "homeassistant.startupProbe" .Values.startupProbe | nindent 12 }}
           resources:
-            {{- include "homeassistant.resources" .Values.resources | nindent 12 }}
+            {{- include "homeassistant.effectiveResources" .Values.resources | nindent 12 }}
           volumeMounts:
             - mountPath: /config/configuration.yaml
               subPath: configuration.yaml