Add install-test stage to the PR pipeline (k3d)

New install-test job in validate-charts.yml: for exactly the charts a PR
changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0,
k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become
Ready. Runs non-blocking (continue-on-error) during the stabilization
phase.

Fixtures live at the repo root under ci/ (not inside chart directories,
so they neither trigger publishes on merge nor get packaged): a stub
OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets
with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate
seed job, static hostPath PVs where charts pin storage classes or need
RWX), plus a shared ci/run-install-test.sh harness that also runs
locally.

Excluded with documented reasons (ci/excluded-charts.txt): satisfactory
(multi-GB image), teamspeak-server (TS6 beta license expired, image
crashes on start), template-chart (placeholder image).

All 14 non-excluded charts verified locally in k3d using only the
committed fixtures.

ci/patchmon/test-values.yaml

@@ -0,0 +1,19 @@
+secrets:
+  redisSecretRef: op://ci/patchmon-redis
+  postgresSecretRef: op://ci/patchmon-postgres
+  oidcSecretRef: op://ci/patchmon-oidc
+  patchmonSecretRef: op://ci/patchmon
+
+ingress:
+  clusterIssuer: ci
+  domain: patchmon.ci.local
+
+patchmon:
+  storage:
+    # Point the RWX assets PVC at the fixture StorageClass so the pre-created
+    # world-writable hostPath PV is used (local-path cannot provision RWX, and
+    # the non-root backend must write its assets dir at boot). Note: the PVC
+    # template guards on .storage.storageClass but renders .storage.class,
+    # so both keys must be set.
+    storageClass: ci-static
+    class: ci-static