[Story] Helm chart: bundle SPIRE as opt-in sub-chart

[shreyanshjain7174]

Parent

Part of #146 (Cross-Cluster Agent Identity Federation epic).

Status

Blocked by validation gate. Depends on SPIRE topology design + Workload API integration.

Goal

Make SPIRE deployable as an opt-in Helm sub-chart so users who enable cross-cluster identity get a working stack in one helm install. Users who don't enable it pay zero footprint cost.

Scope

• Add SPIRE as an optional sub-chart under charts/charts/spire/ (vendor the upstream chart or maintain a minimal wrapper)
• charts/values.yaml extension:

  identity:
    spiffe:
      enabled: false              # opt-in
      bundleSpire: true            # use bundled sub-chart vs BYO
      trustDomain: ""              # required if enabled
      spire:
        server:
          replicas: 1
          ca:
            type: "self-signed"    # self-signed | cert-manager | external
        agent:
          nodeSelector: {}
      federation:
        mode: "connected"          # connected | air-gapped
        peers: []

• values.schema.json updated with new section
• Helm template guards: SPIRE objects render only when identity.spiffe.enabled=true
• helm lint + helm-unittest coverage for enabled/disabled paths
• Document BYO SPIRE path for users with existing deployments

Acceptance

• helm install with defaults: no SPIRE objects rendered
• helm install --set identity.spiffe.enabled=true --set identity.spiffe.trustDomain=test.local: SPIRE server + agent DaemonSet deployed
• make helm-lint green