Restart the server when its config changes (3.0.0+up2026.8.2.java8)

The StatefulSet now carries two annotations over its two configuration
sources, so a change to either produces a new pod template and a controlled
restart:

  checksum/config      the rendered ConfigMap (init.sh) - complete, Helm sees
                       the whole content
  checksum/secret-ref  the rendered OnePasswordItem - the op:// item path only,
                       because the Secret's content is materialized by the
                       operator and is unknown to Helm at render time

Two separate annotations rather than one combined hash: they carry different
guarantees, and a single number would blur "covers everything" and "covers the
path but not the content" into one value that nobody can interpret in a
kubectl describe.

The operator's own operator.1password.io/auto-restart is deliberately NOT set:
it restarts Deployments only. Verified in the operator source (main, 9c3b1b9):
restartWorkloadsWithUpdatedSecrets lists nothing but appsv1.DeploymentList and
getPodTemplate has a single case for *appsv1.Deployment. On this StatefulSet
the annotation would be inert while suggesting the opposite, so the remaining
gap - a rotated value inside the vault item - is documented in values.yaml
instead.

First of the three stage-3-style publishes, so the java8 line goes first and
main ends up on java21. Only the published Java line differs between them:
appVersion 2026.8.2-java8 and the matching minecraft.version default 1.12.2.

Major bump: runtime behaviour changes. A configuration change now costs a full
server restart - 124 s measured for ftb-skies on Longhorn.

Refs #82.

minecraft-server/templates/minecraft-server.sfs.yaml

@@ -15,6 +15,23 @@ spec:
     metadata:
       labels:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+      annotations:
+        # Rolls the pod whenever the rendered ConfigMap changes. init.sh is
+        # mounted with subPath (kubelet never refreshes those in a running
+        # container) and the init container only reads it at pod start, so
+        # without this a changed download URL or working directory would stay
+        # inert while the release still reported success.
+        checksum/config: {{ include (print $.Template.BasePath "/minecraft-server.configmap.yaml") . | sha256sum }}
+        # Deliberately a SEPARATE annotation, and deliberately NOT a hash of the
+        # secret's content: the Kubernetes Secret is materialized by the
+        # 1Password operator, so Helm never sees what is in it. This hash covers
+        # the rendered OnePasswordItem, i.e. the op:// item path - repointing
+        # secrets.minecraftServerRef at a different item now takes effect
+        # instead of silently leaving the old credentials in the running pod.
+        # A change of the item's CONTENT inside the vault is not covered; see
+        # the comment on secrets in values.yaml for why that gap cannot be
+        # closed here and what it means operationally.
+        checksum/secret-ref: {{ include (print $.Template.BasePath "/minecraft-server.secret.yaml") . | sha256sum }}
     spec:
       automountServiceAccountToken: false
       securityContext: