ci: run the freesailarr install-test for real instead of skipping it

freesailarr was excluded from the install-test because gluetun never becomes
healthy without a real Wireguard key and no app container behind its kill
switch can become Ready. The green "Install-test freesailarr pass" was a
25-second SKIP on the most complex chart in the repo - a signal that proved
nothing.

With a CI-only Mullvad key in 1Password the reason is gone:

- ci/run-install-test.sh learns a general rule: ci/<chart>/fixtures.env.yaml is
  rendered with envsubst before it is applied, restricted to the variable names
  a chart declares in REQUIRED_ENV. A missing or empty declared variable fails
  the run loudly and names the variable - it never skips the chart.
- The install-test job loads the key from 1Password Connect for freesailarr
  only, following the pattern publish-helm-chart.yml documents: values via
  steps.<id>.outputs.*, mapped into the step's own env, quoted, with ":?"
  guards that name the missing op:// field before a cluster is created.
- Fixtures for freesailarr: three media claims, the gluetun secret template
  with variable names only, firewallOutboundSubnets so the kill switch does not
  block cluster DNS, and INSTALL_TIMEOUT=900 for nine containers.

freesailarr/Chart.yaml goes 3.0.0+up1.0.0 -> 3.0.1+up1.0.0. That bump is
deliberately empty of content: the install-test matrix follows changed chart
directories, and without it this PR could not run the test it adds.

ci/freesailarr/test-values.yaml

@@ -0,0 +1,39 @@
+# freesailarr: the whole stack in one pod - gluetun plus eight app containers
+# that share its network namespace and sit behind its kill switch. Nothing here
+# is a shortcut around that: the install-test brings up a real Wireguard tunnel
+# with a CI-only Mullvad key (see ci/freesailarr/fixtures.env.yaml), because a
+# gluetun without a handshake keeps every app container from becoming Ready.
+#
+# Release name is ci, so the chart looks for the gluetun credentials in the
+# Secret ci-freesailarr-gluetun-secret, which the fixtures create. The chart's
+# own OnePasswordItem CR applies against the stub CRD and stays unreconciled -
+# there is no 1Password operator in the CI cluster.
+secrets:
+  # Required by the chart. Only the CR's itemPath, never resolved in CI.
+  gluetunSecretRef: op://ci/freesailarr-gluetun
+
+media:
+  # The three media claims are pre-created in fixtures.yaml (one claim per
+  # category, no subPath - the shared-claim layout is a values question, not a
+  # startup question). local-path hands out its directories mode 0777, so the
+  # claim roots are writable for PUID/PGID as the chart requires.
+  downloads:
+    existingClaim: ci-freesailarr-downloads
+  movies:
+    existingClaim: ci-freesailarr-movies
+  tv:
+    existingClaim: ci-freesailarr-tv
+
+gluetun:
+  vpn:
+    # Without this the kill switch drops cluster-internal egress as well, and
+    # the very first DNS lookup against cluster DNS fails. k3s defaults:
+    # 10.42.0.0/16 pods, 10.43.0.0/16 services.
+    firewallOutboundSubnets: "10.42.0.0/16,10.43.0.0/16"
+
+ingress:
+  # Shared-domain mode with a placeholder host: the Ingress objects only have to
+  # be accepted by the API server. There is no ingress-nginx and no cert-manager
+  # in the CI cluster, and the install-test checks readiness, not routing.
+  host: freesailarr.example.com
+  clusterIssuer: ci