Add install-test stage to the PR pipeline (k3d)

New install-test job in validate-charts.yml: for exactly the charts a PR
changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0,
k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become
Ready. Runs non-blocking (continue-on-error) during the stabilization
phase.

Fixtures live at the repo root under ci/ (not inside chart directories,
so they neither trigger publishes on merge nor get packaged): a stub
OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets
with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate
seed job, static hostPath PVs where charts pin storage classes or need
RWX), plus a shared ci/run-install-test.sh harness that also runs
locally.

Excluded with documented reasons (ci/excluded-charts.txt): satisfactory
(multi-GB image), teamspeak-server (TS6 beta license expired, image
crashes on start), template-chart (placeholder image).

All 14 non-excluded charts verified locally in k3d using only the
committed fixtures.

ci/patchmon/fixtures.yaml

@@ -0,0 +1,269 @@
+# Fixtures for the patchmon install-test: throwaway postgres + redis, a dex
+# OIDC provider, the secrets the 1Password operator would otherwise
+# materialize (release name: ci), a pre-bound world-writable hostPath PV for
+# the assets volume (the non-root backend writes agent assets at boot;
+# hostPath does not support fsGroup), and a Service alias "backend": the
+# frontend image's nginx template resolves an upstream host literally named
+# "backend" at startup (found during the probes verification of PR #21).
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: ci-static
+provisioner: kubernetes.io/no-provisioner
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: node-setup
+spec:
+  backoffLimit: 2
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: setup
+          image: public.ecr.aws/docker/library/busybox:1.36
+          command:
+            - sh
+            - -c
+            - >
+              mkdir -p /pv/patchmon/patchmon-assets /pv/patchmon/patchmon-agents &&
+              chmod -R 0777 /pv/patchmon
+          volumeMounts:
+            - name: pv
+              mountPath: /pv
+      volumes:
+        - name: pv
+          hostPath:
+            path: /var/lib/ci-pv
+            type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: ci-patchmon-data
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    # The assets PVC is shared by backend and frontend as ReadWriteMany.
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ci-static
+  claimRef:
+    namespace: default
+    name: ci-patchmon-pvc
+  hostPath:
+    path: /var/lib/ci-pv/patchmon
+    type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+spec:
+  selector:
+    app: ci-patchmon-backend
+  ports:
+    - name: http
+      port: 80
+      targetPort: 3001
+    - name: direct
+      port: 3001
+      targetPort: 3001
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-patchmon-postgres-secret
+stringData:
+  database-url: postgresql://ci:ci@postgres:5432/patchmon
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-patchmon-redis-secret
+stringData:
+  host: redis
+  port: "6379"
+  username: default
+  password: cipass
+  db: "0"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-patchmon-patchmon-secret
+stringData:
+  jwt-secret: patchmon-ci-jwt-secret-0123456789abcdef0123456789abcdef
+  encryption-key: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
+  session-secret: patchmon-ci-session-secret-0123456789abcdef0123456789abcdef
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-patchmon-oidc-secret
+stringData:
+  issuer-url: http://dex.default.svc.cluster.local:5556/dex
+  client-id: ci-client
+  client-secret: ci-client-secret
+  redirect-uri: https://patchmon.ci.local/auth/callback
+  requested-scopes: openid profile email
+  button-text: CI SSO
+  user-group-name: users
+  admin-group-name: admins
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  labels:
+    app: postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: public.ecr.aws/docker/library/postgres:16-alpine
+          env:
+            - name: POSTGRES_USER
+              value: ci
+            - name: POSTGRES_PASSWORD
+              value: ci
+            - name: POSTGRES_DB
+              value: patchmon
+          ports:
+            - containerPort: 5432
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "ci"]
+            periodSeconds: 5
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+      volumes:
+        - name: data
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+spec:
+  selector:
+    app: postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  labels:
+    app: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: public.ecr.aws/docker/library/redis:7-alpine
+          args: ["redis-server", "--requirepass", "cipass"]
+          ports:
+            - containerPort: 6379
+          readinessProbe:
+            tcpSocket:
+              port: 6379
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+spec:
+  selector:
+    app: redis
+  ports:
+    - port: 6379
+      targetPort: 6379
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dex-config
+data:
+  config.yaml: |
+    issuer: http://dex.default.svc.cluster.local:5556/dex
+    storage:
+      type: memory
+    web:
+      http: 0.0.0.0:5556
+    oauth2:
+      skipApprovalScreen: true
+    staticClients:
+      - id: ci-client
+        secret: ci-client-secret
+        name: CI Client
+        redirectURIs:
+          - https://patchmon.ci.local/auth/callback
+    enablePasswordDB: true
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dex
+  labels:
+    app: dex
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dex
+  template:
+    metadata:
+      labels:
+        app: dex
+    spec:
+      containers:
+        - name: dex
+          image: ghcr.io/dexidp/dex:v2.41.1
+          command: ["dex", "serve", "/etc/dex/cfg/config.yaml"]
+          ports:
+            - containerPort: 5556
+          readinessProbe:
+            httpGet:
+              path: /dex/healthz
+              port: 5556
+            periodSeconds: 5
+          volumeMounts:
+            - name: config
+              mountPath: /etc/dex/cfg
+      volumes:
+        - name: config
+          configMap:
+            name: dex-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dex
+spec:
+  selector:
+    app: dex
+  ports:
+    - port: 5556
+      targetPort: 5556

ci/patchmon/test-values.yaml

@@ -0,0 +1,19 @@
+secrets:
+  redisSecretRef: op://ci/patchmon-redis
+  postgresSecretRef: op://ci/patchmon-postgres
+  oidcSecretRef: op://ci/patchmon-oidc
+  patchmonSecretRef: op://ci/patchmon
+
+ingress:
+  clusterIssuer: ci
+  domain: patchmon.ci.local
+
+patchmon:
+  storage:
+    # Point the RWX assets PVC at the fixture StorageClass so the pre-created
+    # world-writable hostPath PV is used (local-path cannot provision RWX, and
+    # the non-root backend must write its assets dir at boot). Note: the PVC
+    # template guards on .storage.storageClass but renders .storage.class,
+    # so both keys must be set.
+    storageClass: ci-static
+    class: ci-static