add helm chart README with third-party install guide

[bborbe]

Adds helm/README.md — the third-party install guide, the last-mile of the "reusable by others" goal (a newcomer can deploy from docs alone).

Covers:

• Prerequisites — k8s, Kafka, image pull access (public docker.io or mirror), Sentry via TeamVault or plain Secret, GitHub App/provider creds, the auto-installed Config CRD.
• Install — helm install ... oci://registry-1.docker.io/bborbe/agent --version 0.2.0 --values values.yaml, plus a minimal executor-only values example.
• Full values reference — global, executor, controller, agents list, recurringTaskCreator (with the storageClassName/gitRestUrl/strimzi caveats).
• Generic cluster section — explicit divergence from quant: no keel, public docker.io (no mirror), plain Secrets (no TeamVault), no Strimzi mTLS, own namespace.
• Two-chart story — core agent chart + forthcoming maintainer chart.

Docs-only; no template/logic changes.

🤖 Generated with Claude Code

[ben-s-pull-request-reviewer]

{
  "verdict": "approve",
  "summary": "Documentation-only PR adding helm/README.md and updating CHANGELOG.md. All six plan concerns were verified against the actual chart files — version number, values schema, CRD presence, caveats, and prerequisites are all accurate. No code changes; no bugs or security issues.",
  "comments": [],
  "concerns_addressed": [
    "correctness: helm install command references version 0.2.0 — verified matches Chart.yaml version field",
    "correctness: All documented values fields (global, executor, controller, agents, recurringTaskCreator) exist in values.yaml schema",
    "correctness: Config CRD auto-install claim verified — CRD exists at helm/crds/config-crd.yaml and chart installs it",
    "correctness: storageClassName defaults to \"\" (cluster default, portable), gitRestUrl \"vault-obsidian-<vaultName>:9090\" assumption and strimziNamespace caveats all accurately documented",
    "docs: Sentry via TeamVault or plain Secret both correctly represented in values.yaml (dsn + existingSecret pattern)",
    "docs: maintainer chart correctly described as forthcoming — not yet present in repo"
  ]
}

[ben-s-pull-request-reviewer]

Based on my review of the PR #31 "add helm chart README with third-party install guide", here is my analysis:

Files changed: CHANGELOG.md (added unreleased entry), helm/README.md (new 209-line documentation)

Review findings:

Must Fix (Critical): None

Should Fix (Important): None — all plan concerns verified:

• ✅ Helm install command syntax uses correct OCI registry format (oci://registry-1.docker.io/bborbe/agent), --version 0.2.0 (matches Chart.yaml chart version), and --values values.yaml
• ✅ Values reference table cross-checked against helm/values.yaml — all key names, defaults, and required fields match exactly
• ✅ controller.gitRestUrl default derivation (http://vault-obsidian-<vaultName>:9090) is clearly documented as a quant-specific assumption (both in README line 111 and values.yaml lines 95-98)
• ✅ No hardcoded secrets — only Secret key names referenced (sentry-dsn, ANTHROPIC_AUTH_TOKEN, SENTRY_DSN, gateway-secret)

Nice to Have (Optional): None — README is thorough and well-structured

CHANGELOG verification: The unreleased entry follows the project's changelog conventions correctly.

License check: ✅ LICENSE file present at repo root.

---

{
  "verdict": "approve",
  "summary": "Docs-only PR adding a comprehensive helm chart README with 209 lines covering prerequisites, OCI-based helm install, full values reference, generic cluster guidance, and the two-chart story. All three plan concerns (helm syntax, values cross-check, gitRestUrl assumption) verified satisfactory. No hardcoded secrets detected.",
  "comments": [],
  "concerns_addressed": [
    "correctness: helm install command syntax (OCI registry, --version flag, --values) verified against Chart.yaml — uses chart version 0.2.0, requires helm >= 3.8 ✓",
    "correctness: values reference table cross-checked against helm/values.yaml — all 50+ entries match on key names, defaults, and required fields ✓",
    "correctness: controller.gitRestUrl default http://vault-obsidian-<vaultName>:9090 documented as quant-specific assumption in both README (line 111) and values.yaml (lines 95-98) ✓",
    "security: no secrets or credentials hardcoded — only Secret key names referenced (sentry-dsn, ANTHROPIC_AUTH_TOKEN, SENTRY_DSN, gateway-secret) ✓"
  ]
}