bentopdf: new chart for the PDF toolbox (1.0.0+up2.8.7)

BentoPDF computes entirely in the visitor's browser; the container only serves
static files through nginx. The chart is therefore close to cyberchef - same
nginx-unprivileged base, uid 101, port 8080, probes on "/" - with four
differences that shaped the design.

Runtime config.json. The one setting reachable at runtime is the tool list.
It is a static file in the middle of the web root, so it is mounted by
subPath: a directory mount would hide the whole application. subPath mounts
are never refreshed by the kubelet, which makes the checksum/config annotation
(#82) load-bearing rather than decorative. bentopdf.config is passed through
verbatim, like searxng's settings, so a key upstream adds tomorrow is a values
change and not a chart change.

Three env switches that would kill the pod. PORT, DISABLE_IPV6 and
ROBOTS_NOINDEX are implemented as "sed -i" against files in the image, run
under "set -e" in /docker-entrypoint.d/, and the base image's entrypoint
aborts when one of them fails. With readOnlyRootFilesystem: true the pod
therefore never starts instead of ignoring the switch - measured in k3d as
CrashLoopBackOff, exit 1, "sed: can't create temp file
'/etc/nginx/nginx.confXXXXXX': Read-only file system". None of the three is
offered as a first-class value; values.yaml names the failure picture and the
escape hatch (env block plus readOnlyRootFilesystem: false).

Writable paths were measured, not copied from the upstream chart.
/etc/nginx/tmp holds the pid file and /var/cache/nginx is where nginx creates
its temp directories at startup - without it the master aborts with
'mkdir() "/var/cache/nginx/client_temp" failed'. /var/run is deliberately not
mounted: the running pod proves it is unnecessary.

Everything else about BentoPDF is a build-time argument and out of reach for
any chart; values.yaml says so explicitly rather than leaving it to be
discovered. Two accepted consequences are named there too: some tools fetch
WASM modules from a public CDN at runtime, and the served pages carry a
canonical link to the vendor's site.

Fixes #174

ci/bentopdf/test-values.yaml

@@ -0,0 +1,20 @@
+# bentopdf: stateless, no secrets, no volumes, nothing to stand up - so there
+# is no fixtures.yaml (cyberchef is the precedent for a chart with only
+# test-values.yaml). The Ingress just has to apply - there is no
+# ingress-nginx/cert-manager in the CI cluster.
+ingress:
+  domain: bentopdf.ci.local
+  clusterIssuer: ci
+
+# Deliberately NOT the chart default of {}. An empty config renders "{}",
+# which is byte-identical to the config.json the image already ships - so the
+# install-test would pass without ever proving that the ConfigMap, the subPath
+# mount into the web root and the checksum/config annotation actually work.
+# With an entry here, the served /config.json differs from the image's own
+# file, and a broken mount becomes visible instead of blending in.
+bentopdf:
+  config:
+    disabledTools:
+      - edit-pdf
+    editorDisabledCategories:
+      - redaction