Add freesailarr chart: gluetun-tunneled media automation stack

Single-pod StatefulSet running gluetun (appVersion 3.41.1) as Wireguard
VPN gateway with qbittorrent, prowlarr, flaresolverr, radarr, recyclarr,
sonarr, seerr and bazarr sharing its network namespace. Config volumes
via volumeClaimTemplates, media libraries as existing claims, per-app
enable/ingress toggles, computed FIREWALL_INPUT_PORTS, hardened
security contexts with documented per-image deviations. Wires up
publish workflow, change-app-version choice, install-test exclusion
and README overview.

.github/workflows/change-app-version.yml

@@ -35,6 +35,7 @@ on:
           - minecraft-router
           - minecraft-server
           - rss-bridge
+          - freesailarr
   workflow_call:
     inputs:
       app-version: