feat(deployment)!: configurable init containers and Secret checksum lookup

The chart-managed init containers were hardcoded inside `deployment.yaml`. Their image, environment, resources,
security context and volume mounts could not be adjusted individually, and custom init containers could only be
prepended or appended as a whole via `preExtraInitContainers`/`postExtraInitContainers`.

The init containers are now rendered from `deployment.initContainers`, an ordered list whose entries either `link` a
chart-managed init container (`initDirectories`, `initAppIni`, `initConfigureGPG`, `initConfigureGitea`) or provide a
free-form `container` definition. This allows custom containers at any position and makes the execution order
explicit. Each linked init container has its own configuration block in `values.yaml` and falls back to
`deployment.gitea.securityContext` and `initContainers.resources` when unset.

To support per-container images, `gitea.image` was split into the generic helper `gitea.image.name`, which renders an
arbitrary `image` dict instead of only `deployment.gitea.image`.

The pod annotations moved from `deployment.yaml` into the new helper `gitea.pod.annotations`. The SHA sum annotations
now also cover user-provided Secrets: their content is unknown to the chart, so the Secret is read from the cluster via
Helm's `lookup` function. Chart-managed Secrets keep using the rendered manifest, because the cluster still holds their
pre-upgrade state during rendering.

Because `lookup` requires `get` permission on Secrets and silently returns nothing during client-side rendering
(`helm template`, `--dry-run`, Argo CD without a live cluster), `addSHASumAnnotation` now defaults to `false`. The
trade-offs are documented in the README so users can make an informed decision.

BREAKING CHANGE: `preExtraInitContainers` and `postExtraInitContainers` have been removed. Add an entry with a
`container` key before or after the linked init containers in `deployment.initContainers` instead.

BREAKING CHANGE: `secrets.<secret>.addSHASumAnnotation` now defaults to `false`. Set it to `true` explicitly to keep
the rollout trigger on Secret changes.

Co-authored-by: Copilot <copilot@github.com>

unittests/helm/deployment/extraInitContainers.yaml

@@ -37,12 +37,17 @@ tests:
 
   - it: Render the deployment (extraInitContainers)
     set:
-      postExtraInitContainers:
-        - name: foo
-          image: docker.io/library/busybox:latest
-      preExtraInitContainers:
-        - name: bar
-          image: docker.io/library/busybox:latest
+      deployment.initContainers:
+        - container:
+            name: bar
+            image: docker.io/library/busybox:latest
+        - link: "initDirectories"
+        - link: "initAppIni"
+        - link: "initConfigureGPG"
+        - link: "initConfigureGitea"
+        - container:
+            name: foo
+            image: docker.io/library/busybox:latest
       secrets.gpg.enabled: true
       secrets.gpg.existingSecret.enabled: true
       secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
@@ -54,15 +59,55 @@ tests:
           path: spec.template.spec.initContainers
           count: 6
         template: templates/gitea/deployment.yaml
-      - contains:
-          path: spec.template.spec.initContainers
-          content:
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: bar
+        template: templates/gitea/deployment.yaml
+      - equal:
+          path: spec.template.spec.initContainers[5].name
+          value: foo
+        template: templates/gitea/deployment.yaml
+
+  - it: renders the chart-managed init containers in the configured order
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.initContainers:
+        - link: "initConfigureGitea"
+        - link: "initDirectories"
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: configure-gitea
+      - equal:
+          path: spec.template.spec.initContainers[1].name
+          value: init-directories
+
+  - it: fails when an init container entry sets both container and link
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.initContainers:
+        - link: "initDirectories"
+          container:
             name: foo
             image: docker.io/library/busybox:latest
-        template: templates/gitea/deployment.yaml
-      - contains:
-          path: spec.template.spec.initContainers
-          content:
-            name: bar
-            image: docker.io/library/busybox:latest
-        template: templates/gitea/deployment.yaml
+    asserts:
+      - failedTemplate:
+          errorMessage: "deployment.initContainers[0]: `container` and `link` are mutually exclusive"
+
+  - it: fails when an init container entry sets neither container nor link
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.initContainers:
+        - name: foo
+    asserts:
+      - failedTemplate:
+          errorMessage: "deployment.initContainers[0]: either `container` or `link` must be set"
+
+  - it: fails when an init container links to an unknown configuration
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.initContainers:
+        - link: "initSomething"
+    asserts:
+      - failedTemplate:
+          errorMessage: "deployment.initContainers[0]: unknown link `initSomething`, expected one of: initAppIni, initConfigureGPG, initConfigureGitea, initDirectories"