ci: run the freesailarr install-test for real instead of skipping it

freesailarr was excluded from the install-test because gluetun never becomes
healthy without a real Wireguard key and no app container behind its kill
switch can become Ready. The green "Install-test freesailarr pass" was a
25-second SKIP on the most complex chart in the repo - a signal that proved
nothing.

With a CI-only Mullvad key in 1Password the reason is gone:

- ci/run-install-test.sh learns a general rule: ci/<chart>/fixtures.env.yaml is
  rendered with envsubst before it is applied, restricted to the variable names
  a chart declares in REQUIRED_ENV. A missing or empty declared variable fails
  the run loudly and names the variable - it never skips the chart.
- The install-test job loads the key from 1Password Connect for freesailarr
  only, following the pattern publish-helm-chart.yml documents: values via
  steps.<id>.outputs.*, mapped into the step's own env, quoted, with ":?"
  guards that name the missing op:// field before a cluster is created.
- Fixtures for freesailarr: three media claims, the gluetun secret template
  with variable names only, firewallOutboundSubnets so the kill switch does not
  block cluster DNS, and INSTALL_TIMEOUT=900 for nine containers.

freesailarr/Chart.yaml goes 3.0.0+up1.0.0 -> 3.0.1+up1.0.0. That bump is
deliberately empty of content: the install-test matrix follows changed chart
directories, and without it this PR could not run the test it adds.

ci/freesailarr/fixtures.yaml

@@ -0,0 +1,43 @@
+# Fixtures for the freesailarr install-test: the three media claims the chart
+# mounts but never creates (media.*.existingClaim). The config volumes come from
+# the StatefulSet's own volumeClaimTemplates and need nothing here.
+#
+# Default StorageClass (k3d's local-path), so the claims stay Pending until the
+# pod is scheduled - WaitForFirstConsumer, which is exactly what the chart sees
+# on a real cluster. local-path creates its directories mode 0777, so the claim
+# roots are writable for PUID/PGID 1000 without a chown job.
+#
+# The gluetun credentials Secret is NOT here: it carries values that must not be
+# committed and lives in fixtures.env.yaml.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ci-freesailarr-downloads
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ci-freesailarr-movies
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ci-freesailarr-tv
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi