ci: hold every scalar that must be a string, and the required podAffinity

The test Gitea #11 asked for ("whoever fixes this ships a test case that would
have caught it"), plus the guard for the fix #101 introduces.

ci/run-yaml-scalar-render-test.sh renders every chart with the fixtures the
install-test already uses and asserts three properties Kubernetes itself
requires, so no per-chart expectations are needed: a CronJob schedule is a
non-empty string, every env[].value of every container and initContainer is a
string, and every label and annotation value is a string. The first catches the
loud failure - the render aborting with a YAML error that names the template
and not the value - and the other two catch the quiet one, where the render
succeeds and the API server rejects the object at apply time.

WHY A NEW JOB AND NOT THE INSTALL-TEST. The object that carried the defect is
rendered by no fixture at all: paperless-ngx' consume CronJob sits behind
smbConnection.enabled, false in the chart defaults and false in its install-test
fixture, since the CI cluster has no SMB CSI driver. Nothing in this repository
ever produced it. So the overlays under ci/yaml-scalar/ are the test, not the
scaffolding: they switch such objects on AND feed them hostile values, and the
script fails when an overlay stops reaching its object or when the run asserted
nothing at all.

The fail path was exercised in all three shapes against a throwaway copy of the
chart as it stands on main, not reasoned about: the bare schedule aborted with
"yaml: line 6: did not find expected alphabetic or numeric character"; with only
the schedule quoted, the star-valued env entry aborted on the StatefulSet
instead; and with only the bool-looking value left - a render that succeeds -
the type assertion named the variable, the container and the API server's
message. Green repo-wide otherwise: 30 charts, 408 scalars, 0 failed.

ci/run-selector-match-test.sh additionally holds every
requiredDuringSchedulingIgnoredDuringExecution podAffinity term against all pod
templates of the same render (Gitea #101). That case is not the gap the script's
header describes: a preference that cannot be met is dropped and an
anti-affinity over zero pods is satisfied, but a REQUIRED term matching no pod
can never be satisfied and the pod stays Pending for good. paperless-ngx' mover
selects a label written in another template, which is exactly the copy this test
holds - renaming it would leave both templates rendering perfectly while the
mover silently stopped moving. Exercised by doing that rename in a throwaway
copy: one FAIL naming the selector, the pod templates it missed and the labels
actually present.

Six charts still render their env block bare (matrix-synapse, minecraft-router,
minecraft-server, rallly, satisfactory, teamspeak-server). They are green only
because no fixture of theirs sets a hostile value; README now says so instead of
repeating template-chart's claim that every chart quotes.

Part of #11
Part of #101

ci/run-selector-match-test.sh

@@ -52,10 +52,22 @@
 #
 # WHAT IS DELIBERATELY NOT CHECKED
 #
-#   - podAffinity / podAntiAffinity. They carry labelSelectors too, but their
-#     semantics are "relative to pods that exist", and an anti-affinity term
-#     matching nothing is a legitimate configuration rather than a mistake.
-#     Out of scope, and named so that the gap is not mistaken for coverage.
+#   - preferred podAffinity and podAntiAffinity of either strength. They carry
+#     labelSelectors too, but their semantics are "relative to pods that exist",
+#     and a term matching nothing is a legitimate configuration rather than a
+#     mistake: a preference that cannot be met is dropped and an anti-affinity
+#     over zero pods is satisfied. Out of scope, and named so that the gap is
+#     not mistaken for coverage.
+#
+#     requiredDuringSchedulingIgnoredDuringExecution podAffinity is NOT in that
+#     gap and is checked (Gitea #101). Its failure is not a preference quietly
+#     dropped: a required term whose selector matches no pod in the release can
+#     never be satisfied, so the pod stays Pending forever. For the workload
+#     that introduced one here - paperless-ngx' consume CronJob, pinned onto the
+#     node of its StatefulSet pod so that Longhorn will mount the shared RWX
+#     volume - that would mean a mover that silently stops moving, with one
+#     Pending pod per schedule and a green render behind it. The term names a
+#     label written in ANOTHER template, which is the copy this test holds.
 #   - selectors expressed ONLY through matchExpressions. Evaluating a set-based
 #     requirement means reimplementing label-selector semantics, which is a
 #     second parser by another name. Those are REPORTED as "not checked" and
@@ -343,6 +355,55 @@ for doc in pdbs:
                         ", ".join("%s=%s" % kv for kv in sorted(match_labels.items())),
                         len(all_templates), "; ".join(known) or "none"))
 
+# 3. Every REQUIRED podAffinity term, against ALL pod templates of the render
+#    (Gitea #101). Not against its own template: the whole point of such a term
+#    is to select a DIFFERENT workload's pod, so the correct question is whether
+#    anything in this release carries the labels it asks for. Preferred terms and
+#    anti-affinity of either strength are left alone - see the header.
+for where, template in all_templates:
+    affinity = template.get("spec", {}).get("affinity")
+    if not isinstance(affinity, dict):
+        continue
+    pod_affinity = affinity.get("podAffinity")
+    if not isinstance(pod_affinity, dict):
+        continue
+    terms = pod_affinity.get("requiredDuringSchedulingIgnoredDuringExecution")
+    if not isinstance(terms, list):
+        continue
+    for i, term in enumerate(terms):
+        if not isinstance(term, dict):
+            lines.append("FAIL|%s: required podAffinity[%d] at %s is not a mapping"
+                         % (chart, i, where))
+            continue
+        tag = "required podAffinity[%d] on %s at %s" % (
+            i, term.get("topologyKey", "<no topologyKey>"), where)
+        match_labels, reason = classify(term.get("labelSelector"), tag)
+        if match_labels is None:
+            if term.get("labelSelector") is None:
+                lines.append("FAIL|%s: %s" % (chart, reason))
+            else:
+                lines.append("SKIP|%s: %s" % (chart, reason))
+            continue
+        hits = [w for w, t in all_templates if matches(match_labels, labels_of(t))]
+        if hits:
+            lines.append("OK|%s: %s matches %d pod template(s): %s"
+                         % (chart, tag, len(hits), ", ".join(hits)))
+        else:
+            known = sorted({"%s=%s" % kv for _, t in all_templates for kv in labels_of(t).items()})
+            lines.append("FAIL|%s: %s selects %s, which matches NONE of the %d "
+                         "pod template(s) in the same render. A REQUIRED "
+                         "podAffinity term that matches no pod can never be "
+                         "satisfied, so the pod it is attached to stays Pending "
+                         "forever - for a CronJob that means one Pending pod per "
+                         "schedule and a workload that silently stopped running, "
+                         "with nothing in the render to show for it. The usual "
+                         "cause is a label renamed in the template that carries "
+                         "the selected pod. Labels actually present on the pod "
+                         "templates: %s"
+                         % (chart, tag,
+                            ", ".join("%s=%s" % kv for kv in sorted(match_labels.items())),
+                            len(all_templates), "; ".join(known) or "none"))
+
 for line in lines:
     print(line)
 PY