Add install-test stage to the PR pipeline (k3d)

New install-test job in validate-charts.yml: for exactly the charts a PR
changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0,
k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become
Ready. Runs non-blocking (continue-on-error) during the stabilization
phase.

Fixtures live at the repo root under ci/ (not inside chart directories,
so they neither trigger publishes on merge nor get packaged): a stub
OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets
with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate
seed job, static hostPath PVs where charts pin storage classes or need
RWX), plus a shared ci/run-install-test.sh harness that also runs
locally.

Excluded with documented reasons (ci/excluded-charts.txt): satisfactory
(multi-GB image), teamspeak-server (TS6 beta license expired, image
crashes on start), template-chart (placeholder image).

All 14 non-excluded charts verified locally in k3d using only the
committed fixtures.

ci/homeassistant/fixtures.yaml

@@ -0,0 +1,19 @@
+# Fixtures for the homeassistant install-test: the config secret the
+# 1Password operator would otherwise materialize (release name: ci). The
+# chart mounts the three keys as configuration.yaml, http-config.yaml and
+# recorder-config.yaml under /config.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-homeassistant-config-secret
+stringData:
+  config: |
+    default_config:
+    http: !include http-config.yaml
+    recorder: !include recorder-config.yaml
+  http-config: |
+    use_x_forwarded_for: true
+    trusted_proxies:
+      - 10.42.0.0/16
+  recorder-config: |
+    db_url: sqlite:////config/home-assistant_v2.db

ci/homeassistant/settings.env

@@ -0,0 +1,2 @@
+# Home Assistant's first boot installs/initializes integrations.
+INSTALL_TIMEOUT=600

ci/homeassistant/test-values.yaml

@@ -0,0 +1,9 @@
+secrets:
+  configSecretRef: op://ci/homeassistant-config
+
+core:
+  storage:
+    # k3d's default dynamic provisioner (the values default "default" does
+    # not exist there). Home Assistant starts as root, so writability of the
+    # dynamically provisioned volume is not an issue.
+    storageClass: local-path