additionalProperties: false on every chart-owned object level, so a key the chart does not read is rejected at render time instead of being silently ignored. Objects passed verbatim into the pod spec (probes, securityContext, global) stay open - Kubernetes owns their schema there. Major bump: a schema can break existing deployments that carry dead keys. Refs #68