feat(deployment)!: configurable init containers and Secret checksum lookup

The chart-managed init containers were hardcoded inside `deployment.yaml`. Their image, environment, resources,
security context and volume mounts could not be adjusted individually, and custom init containers could only be
prepended or appended as a whole via `preExtraInitContainers`/`postExtraInitContainers`.

The init containers are now rendered from `deployment.initContainers`, an ordered list whose entries either `link` a
chart-managed init container (`initDirectories`, `initAppIni`, `initConfigureGPG`, `initConfigureGitea`) or provide a
free-form `container` definition. This allows custom containers at any position and makes the execution order
explicit. Each linked init container has its own configuration block in `values.yaml` and falls back to
`deployment.gitea.securityContext` and `initContainers.resources` when unset.

To support per-container images, `gitea.image` was split into the generic helper `gitea.image.name`, which renders an
arbitrary `image` dict instead of only `deployment.gitea.image`.

The pod annotations moved from `deployment.yaml` into the new helper `gitea.pod.annotations`. The SHA sum annotations
now also cover user-provided Secrets: their content is unknown to the chart, so the Secret is read from the cluster via
Helm's `lookup` function. Chart-managed Secrets keep using the rendered manifest, because the cluster still holds their
pre-upgrade state during rendering.

Because `lookup` requires `get` permission on Secrets and silently returns nothing during client-side rendering
(`helm template`, `--dry-run`, Argo CD without a live cluster), `addSHASumAnnotation` now defaults to `false`. The
trade-offs are documented in the README so users can make an informed decision.

BREAKING CHANGE: `preExtraInitContainers` and `postExtraInitContainers` have been removed. Add an entry with a
`container` key before or after the linked init containers in `deployment.initContainers` instead.

BREAKING CHANGE: `secrets.<secret>.addSHASumAnnotation` now defaults to `false`. Set it to `true` explicitly to keep
the rollout trigger on Secret changes.

Co-authored-by: Copilot <copilot@github.com>

unittests/helm/deployment/checksum-annotations.yaml

@@ -11,29 +11,18 @@ templates:
   - templates/gitea/secret_inlineConfig.yaml
   - templates/gitea/secret_metrics.yaml
 tests:
-  - it: adds a checksum annotation for every Secret by default
-    template: templates/gitea/deployment.yaml
-    asserts:
-      - exists:
-          path: spec.template.metadata.annotations["checksum/admin"]
-      - exists:
-          path: spec.template.metadata.annotations["checksum/config"]
-      - exists:
-          path: spec.template.metadata.annotations["checksum/init"]
-      - exists:
-          path: spec.template.metadata.annotations["checksum/inlineConfig"]
-      - exists:
-          path: spec.template.metadata.annotations["checksum/metrics"]
-
-  - it: omits the checksum annotations when addSHASumAnnotation is disabled
+  - it: omits the checksum annotations by default
     template: templates/gitea/deployment.yaml
     set:
-      secrets.admin.addSHASumAnnotation: false
-      secrets.config.addSHASumAnnotation: false
-      secrets.gpg.addSHASumAnnotation: false
-      secrets.init.addSHASumAnnotation: false
-      secrets.inlineConfig.addSHASumAnnotation: false
-      secrets.metrics.addSHASumAnnotation: false
+      secrets.admin.enabled: true
+      secrets.config.enabled: true
+      secrets.gpg.enabled: true
+      secrets.gpg.new.privateKey: |
+        -----BEGIN PGP PRIVATE KEY BLOCK-----
+        -----END PGP PRIVATE KEY BLOCK-----
+      secrets.init.enabled: true
+      secrets.inlineConfig.enabled: true
+      secrets.metrics.enabled: true
     asserts:
       - notExists:
           path: spec.template.metadata.annotations["checksum/admin"]
@@ -48,33 +37,66 @@ tests:
       - notExists:
           path: spec.template.metadata.annotations["checksum/metrics"]
 
+  - it: adds a checksum annotation for every Secret when addSHASumAnnotation is enabled
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.addSHASumAnnotation: true
+      secrets.admin.enabled: true
+
+      secrets.config.addSHASumAnnotation: true
+      secrets.config.enabled: true
+
+      secrets.gpg.addSHASumAnnotation: true
+      secrets.gpg.enabled: true
+      secrets.gpg.new.privateKey: |
+        -----BEGIN PGP PRIVATE KEY BLOCK-----
+        -----END PGP PRIVATE KEY BLOCK-----
+
+      secrets.init.addSHASumAnnotation: true
+      secrets.init.enabled: true
+
+      secrets.inlineConfig.addSHASumAnnotation: true
+      secrets.inlineConfig.enabled: true
+
+      secrets.metrics.addSHASumAnnotation: true
+      secrets.metrics.enabled: true
+    asserts:
+      - exists:
+          path: spec.template.metadata.annotations["checksum/admin"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/config"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/gpg"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/init"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/inlineConfig"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/metrics"]
+
   - it: omits the checksum annotation of a single disabled Secret only
     template: templates/gitea/deployment.yaml
     set:
-      secrets.init.addSHASumAnnotation: false
-    asserts:
-      - exists:
-          path: spec.template.metadata.annotations["checksum/config"]
-      - notExists:
-          path: spec.template.metadata.annotations["checksum/init"]
-      - exists:
-          path: spec.template.metadata.annotations["checksum/inlineConfig"]
+      secrets.admin.addSHASumAnnotation: false
+      secrets.admin.enabled: true
 
-  - it: omits the checksum annotations of Secrets provided by the user
-    template: templates/gitea/deployment.yaml
-    set:
-      secrets.admin.existingSecret.enabled: true
-      secrets.admin.existingSecret.secretName: custom-admin
-      secrets.config.existingSecret.enabled: true
-      secrets.config.existingSecret.secretName: custom-config
-      secrets.gpg.existingSecret.enabled: true
-      secrets.gpg.existingSecret.secretName: custom-gpg
-      secrets.init.existingSecret.enabled: true
-      secrets.init.existingSecret.secretName: custom-init
-      secrets.inlineConfig.existingSecret.enabled: true
-      secrets.inlineConfig.existingSecret.secretName: custom-inline-config
-      secrets.metrics.existingSecret.enabled: true
-      secrets.metrics.existingSecret.secretName: custom-metrics
+      secrets.config.addSHASumAnnotation: false
+      secrets.config.enabled: true
+
+      secrets.gpg.addSHASumAnnotation: false
+      secrets.gpg.enabled: true
+      secrets.gpg.new.privateKey: |
+        -----BEGIN PGP PRIVATE KEY BLOCK-----
+        -----END PGP PRIVATE KEY BLOCK-----
+
+      secrets.init.addSHASumAnnotation: false
+      secrets.init.enabled: true
+
+      secrets.inlineConfig.addSHASumAnnotation: false
+      secrets.inlineConfig.enabled: true
+
+      secrets.metrics.addSHASumAnnotation: false
+      secrets.metrics.enabled: true
     asserts:
       - notExists:
           path: spec.template.metadata.annotations["checksum/admin"]
@@ -88,3 +110,49 @@ tests:
           path: spec.template.metadata.annotations["checksum/inlineConfig"]
       - notExists:
           path: spec.template.metadata.annotations["checksum/metrics"]
+
+  - it: adds the checksum of Secrets provided by the user
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.enabled: true
+      secrets.admin.addSHASumAnnotation: true
+      secrets.admin.existingSecret.enabled: true
+      secrets.admin.existingSecret.secretName: custom-admin
+
+      secrets.config.enabled: true
+      secrets.config.addSHASumAnnotation: true
+      secrets.config.existingSecret.enabled: true
+      secrets.config.existingSecret.secretName: custom-config
+
+      secrets.gpg.enabled: true
+      secrets.gpg.addSHASumAnnotation: true
+      secrets.gpg.existingSecret.enabled: true
+      secrets.gpg.existingSecret.secretName: custom-gpg
+
+      secrets.init.enabled: true
+      secrets.init.addSHASumAnnotation: true
+      secrets.init.existingSecret.enabled: true
+      secrets.init.existingSecret.secretName: custom-init
+
+      secrets.inlineConfig.enabled: true
+      secrets.inlineConfig.addSHASumAnnotation: true
+      secrets.inlineConfig.existingSecret.enabled: true
+      secrets.inlineConfig.existingSecret.secretName: custom-inline-config
+
+      secrets.metrics.enabled: true
+      secrets.metrics.addSHASumAnnotation: true
+      secrets.metrics.existingSecret.enabled: true
+      secrets.metrics.existingSecret.secretName: custom-metrics
+    asserts:
+      - exists:
+          path: spec.template.metadata.annotations["checksum/admin"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/config"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/gpg"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/init"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/inlineConfig"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/metrics"]