template-chart + README: values.schema.json, gate and null-safe helpers

Closes out the schema programme (#68) by moving what the 18 charts taught
into the reference implementation and the binding guidelines.

template-chart:
- values.schema.json as the reference schema: additionalProperties false
  on every chart-owned level, pod-spec passthrough left open, and the
  reasoning inline in the descriptions so a copy carries it along.
- defaultedDict and subBlock plus the per-block fallbacks for both
  security contexts, the three probes and resources, wired into both the
  Deployment and the StatefulSet.
- the reference itself violated guideline 1: its env block reads
  ingress.domain, so with the Ingress gated off it rendered an empty
  value. That read is now required(), and the comment says why - the
  template is what people copy, so it has to teach the guard, not the
  hole.

README, new section "Values that must not lie" with the five rules:
1. a value read outside its obvious template needs its own guard
   (matrix-synapse published '{"m.server": ":443"}' to federation without
   it, rendering cleanly and reporting healthy)
2. probes, contexts and resources through the null-safe helper, never
   behind an "if" - a guard removes the probe instead of showing a null
3. no liveness on an external dependency where a dependency-free path
   exists, otherwise document why on the helper
4. a fallback reproduces THIS chart's defaults, not the repo standard -
   calibre's readOnlyRootFilesystem: false is what keeps the runtime uid
   at 1000 instead of 911 and existing volume data readable
5. a probe default carries its context - port name, Host header, exec
   command - or the probe vanishes (teamspeak) or gets 403 (patchmon)

Plus the two mechanics that are easiest to lose: null reaches schema
validation only for keys WITHOUT a chart default (which is why the helper
and the ["object","null"] types each cover a case the other cannot), and
schemas must be validated against real bundle values - that step caught a
draft of mine that would have broken three live paperless releases.

CLAUDE.md: the new-chart checklist now names the schema and the
adaptation step, since the copied file is chart-specific and wrong until
it is adapted.

freesailarr is not covered: it is not on main yet (#59).

template-chart/templates/xxx.deployment.yaml

@@ -24,7 +24,7 @@ spec:
     spec:
       automountServiceAccountToken: false
       securityContext:
-        {{- toYaml .Values.xxx.securityContext.pod | nindent 8 }}
+        {{- include "xxx.podSecurityContext" .Values.xxx.securityContext | nindent 8 }}
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
           image: "registry/image:{{ .Chart.AppVersion }}"
@@ -52,14 +52,19 @@ spec:
             {{- end }}
           ports:
             {{- toYaml .Values.xxx.ports | nindent 12 }}
+          # Probes, resources and both security contexts go through the
+          # null-safe helpers (#99): an erased block means "chart defaults
+          # apply" instead of a vanished probe or an unhardened container.
+          # Never wrap these in an "if" - a guard hides the erased case
+          # completely instead of rendering a visible null.
           livenessProbe:
-            {{- toYaml .Values.xxx.livenessProbe | nindent 12 }}
+            {{- include "xxx.livenessProbe" .Values.xxx.livenessProbe | nindent 12 }}
           readinessProbe:
-            {{- toYaml .Values.xxx.readinessProbe | nindent 12 }}
+            {{- include "xxx.readinessProbe" .Values.xxx.readinessProbe | nindent 12 }}
           startupProbe:
-            {{- toYaml .Values.xxx.startupProbe | nindent 12 }}
+            {{- include "xxx.startupProbe" .Values.xxx.startupProbe | nindent 12 }}
           resources:
-            {{- include "xxx.resources" .Values.xxx.resources | nindent 12 }}
+            {{- include "xxx.effectiveResources" .Values.xxx.resources | nindent 12 }}
           securityContext:
-            {{- toYaml .Values.xxx.securityContext.container | nindent 12 }}
+            {{- include "xxx.containerSecurityContext" .Values.xxx.securityContext | nindent 12 }}
       restartPolicy: Always