Stage 5: installer chart + release infra, kind e2e pass through the chart

Chart (charts/terdut-operator) generated via kubebuilder's own helm/v2-alpha
plugin from config/'s kustomize output -- CRDs + manager Deployment/RBAC
come from the same markers every other stage already generates, one source
of truth. Hand-added on top: the optional terdutServer values block
(DESIGN.md §10's "helm install and get a server" path, off by default) and
the release-skill plumbing -- .release.conf, release-vars/helm-lint/push/
helm-package/helm-push/release Makefile targets, .gitea/workflows/release.yaml
(test -> image/chart -> scan-image) -- mirroring terdut-server's own shape
(registry/namespace convention, multi-arch buildx push, trivy/govulncheck/
gitleaks scans). ci.yaml gains security and chart jobs to match.

Two real issues caught while wiring this, fixed before either shipped:
- Dockerfile's builder stage didn't pin --platform=$BUILDPLATFORM, which
  would have made a multi-arch release build fail outright on this org's
  runners (no binfmt registration) -- same fix terdut-server's own
  Dockerfile already needed for the same reason.
- govulncheck found one real, reachable finding: google.golang.org/grpc
  v1.82.1 (transitive via controller-runtime's otel exporter), fixed by
  bumping to v1.83.1.

Full golden-path kind e2e pass, this time through `helm install` rather than
raw kustomize: TerdutServer (real terdut-server v0.33.0 image) -> TerdutTeam
-> one of each child kind, each confirmed Ready and then independently
confirmed against terdut-server's own API from inside the cluster (not just
the operator's own status). Deleted every CR in reverse order and confirmed
server-side cleanup the same independent way for all three child kinds, the
team, and the server. No new bugs found -- Stage 1's own kind pass already
caught what a real cluster catches that envtest can't.

Also dropped the kubebuilder helm plugin's default .github/workflows/
scaffold, same as Stage 0 already did for the main scaffold: this org runs
on Gitea, not GitHub.

Not done here, deliberately: an actual tagged release. release-preflight
found no terdut-operator/ entry under Ryuvia/charts yet to bump -- that
one-time wrapper bootstrap is a decision about deploying this operator for
real, not a side effect of finishing this stage.

make fmt lint test helm-lint build all clean.

.gitea/workflows/ci.yaml

@@ -78,6 +78,54 @@ jobs:
       - name: Format, lint and test
         run: make fmt lint test
 
-  # No `chart` job yet -- there's no Helm chart until Stage 6 (ROADMAP.md). No
-  # `security` job yet either (govulncheck/gitleaks, as terdut-server has); add one
-  # alongside `test` once there's controller code worth scanning.
+  # Runs on every push and pull request, unlike the image scan, which needs something
+  # published to scan and so lives in release.yaml -- same split as terdut-server's.
+  # govulncheck reads the source and its module graph, gitleaks reads the working
+  # tree; neither sees what the other does.
+  security:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.26.6-bookworm
+      volumes:
+        - go-mod-cache:/go/pkg/mod
+        - go-build-cache:/root/.cache/go-build
+        - gobin-cache:/go/bin
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ -n "$HEAD_SHA" ]; then
+            git clone "$REPO_URL" .
+            git checkout -q "$HEAD_SHA"
+          else
+            git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+          fi
+
+      - name: Go vulnerability scan (govulncheck)
+        run: make security-go
+
+      - name: Secret scan (gitleaks)
+        run: make security-secrets
+
+  # Host mode, no `container:`: helm is baked into the runner image, and a container
+  # job could not install it -- get.helm.sh is unreachable from the dind bridge, same
+  # reason terdut-server's own chart job runs on the host.
+  chart:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ -n "$HEAD_SHA" ]; then
+            git clone "$REPO_URL" .
+            git checkout -q "$HEAD_SHA"
+          else
+            git clone --depth=1 --branch "$REF_NAME" "$REPO_URL" .
+          fi
+
+      - name: Lint and render the chart
+        run: make helm-lint