Add install-test stage to the PR pipeline (k3d)

New install-test job in validate-charts.yml: for exactly the charts a PR
changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0,
k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become
Ready. Runs non-blocking (continue-on-error) during the stabilization
phase.

Fixtures live at the repo root under ci/ (not inside chart directories,
so they neither trigger publishes on merge nor get packaged): a stub
OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets
with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate
seed job, static hostPath PVs where charts pin storage classes or need
RWX), plus a shared ci/run-install-test.sh harness that also runs
locally.

Excluded with documented reasons (ci/excluded-charts.txt): satisfactory
(multi-GB image), teamspeak-server (TS6 beta license expired, image
crashes on start), template-chart (placeholder image).

All 14 non-excluded charts verified locally in k3d using only the
committed fixtures.

ci/zipline/fixtures.yaml

@@ -0,0 +1,65 @@
+# Fixtures for the zipline install-test: throwaway postgres and the secrets
+# the 1Password operator would otherwise materialize (release name: ci).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-zipline-db-secret
+stringData:
+  connection-url: postgresql://ci:ci@postgres:5432/zipline
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-zipline-core-secret
+stringData:
+  server-secret: zipline-ci-core-secret-0123456789abcdef0123456789abcdef0123456789
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  labels:
+    app: postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: public.ecr.aws/docker/library/postgres:16-alpine
+          env:
+            - name: POSTGRES_USER
+              value: ci
+            - name: POSTGRES_PASSWORD
+              value: ci
+            - name: POSTGRES_DB
+              value: zipline
+          ports:
+            - containerPort: 5432
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "ci"]
+            periodSeconds: 5
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+      volumes:
+        - name: data
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+spec:
+  selector:
+    app: postgres
+  ports:
+    - port: 5432
+      targetPort: 5432

ci/zipline/test-values.yaml

@@ -0,0 +1,9 @@
+config:
+  storage: 1Gi
+  storageClass: local-path
+  domain: zipline.ci.local
+  # The OnePasswordItem CRs only need non-null item paths; the actual
+  # Kubernetes Secrets come from ci/zipline/fixtures.yaml.
+  secretRef:
+    db: op://ci/zipline-db
+    zipline: op://ci/zipline-core