Add install-test stage to the PR pipeline (k3d)

New install-test job in validate-charts.yml: for exactly the charts a PR
changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0,
k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become
Ready. Runs non-blocking (continue-on-error) during the stabilization
phase.

Fixtures live at the repo root under ci/ (not inside chart directories,
so they neither trigger publishes on merge nor get packaged): a stub
OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets
with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate
seed job, static hostPath PVs where charts pin storage classes or need
RWX), plus a shared ci/run-install-test.sh harness that also runs
locally.

Excluded with documented reasons (ci/excluded-charts.txt): satisfactory
(multi-GB image), teamspeak-server (TS6 beta license expired, image
crashes on start), template-chart (placeholder image).

All 14 non-excluded charts verified locally in k3d using only the
committed fixtures.

ci/matrix-synapse/fixtures.yaml

@@ -0,0 +1,95 @@
+# Fixtures for the matrix-synapse install-test. Synapse needs a signing key
+# and a log config on its PVC before it starts, so the PVC is backed by a
+# pre-bound hostPath PV and a seed Job runs "synapse generate" into that
+# directory first (same pattern as the k3d verification for PRs #21/#26).
+# The chart mounts homeserver.yaml from the config secret; the static config
+# below points at the generated key/log-config paths. Release name: ci.
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ci-static
+provisioner: kubernetes.io/no-provisioner
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: ci-matrix-synapse-data
+spec:
+  capacity:
+    storage: 2Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ci-static
+  claimRef:
+    namespace: default
+    name: ci-matrix-synapse-pvc
+  hostPath:
+    path: /var/lib/ci-pv/matrix-synapse
+    type: DirectoryOrCreate
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: synapse-seed
+spec:
+  backoffLimit: 2
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: generate
+          # Same image the chart deploys (appVersion of matrix-synapse).
+          image: ghcr.io/element-hq/synapse:v1.149.1
+          args: ["generate"]
+          env:
+            - name: SYNAPSE_SERVER_NAME
+              value: synapse.ci.local
+            - name: SYNAPSE_REPORT_STATS
+              value: "no"
+            # Match the UID/GID the chart runs synapse with, so the generated
+            # signing key (mode 0600) is readable by the server container.
+            - name: UID
+              value: "1000"
+            - name: GID
+              value: "1000"
+          volumeMounts:
+            - name: pv
+              mountPath: /data
+              subPath: matrix-synapse-data
+      volumes:
+        - name: pv
+          hostPath:
+            path: /var/lib/ci-pv/matrix-synapse
+            type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-matrix-synapse-config-secret
+stringData:
+  homeserver.yaml: |
+    server_name: "synapse.ci.local"
+    pid_file: /data/homeserver.pid
+    listeners:
+      - port: 8008
+        tls: false
+        type: http
+        x_forwarded: true
+        resources:
+          - names: [client, federation]
+            compress: false
+    database:
+      name: sqlite3
+      args:
+        database: /data/homeserver.db
+    log_config: "/data/synapse.ci.local.log.config"
+    media_store_path: /media_store
+    signing_key_path: "/data/synapse.ci.local.signing.key"
+    registration_shared_secret: "ci-registration-shared-secret"
+    macaroon_secret_key: "ci-macaroon-secret-key"
+    form_secret: "ci-form-secret"
+    report_stats: false
+    trusted_key_servers:
+      - server_name: "matrix.org"
+    suppress_key_server_warning: true

ci/matrix-synapse/settings.env

@@ -0,0 +1,2 @@
+# Synapse first start (SQLite schema setup) plus the config seed job.
+INSTALL_TIMEOUT=600

ci/matrix-synapse/test-values.yaml

@@ -0,0 +1,14 @@
+matrix:
+  serverName: synapse.ci.local
+  configSecretRef: op://ci/matrix-synapse-config
+  delegation:
+    enabled: true
+    serverUrl: ci.local
+
+storage:
+  amount: 2Gi
+  storageClass: ci-static
+
+ingress:
+  clusterIssuer: ci
+  domain: matrix.ci.local