feat(mecak8s): converge kustomize manifests into the Helm chart

[jhrozek]

Summary

deploy/mecak8s/ (kustomize) + deploy/mecak8s-oidc/ (kustomize overlay) duplicated the same storage-free agent workload deploy/helm/mecak8s/ (Helm) already defines, and had already drifted from it. This PR:

• Adds caller-identity (oidc.*) support to the chart, including the raw-driver NetworkPolicy the OIDC overlay used to carry — gated on oidc.enabled, since it's a tenant-isolation boundary, not the general egress policy this chart deliberately omits (network isolation is left to the cluster's own policy layer).
• Migrates task deploy:check, the kind e2e suite (e2e/k8s/), and the k8s-e2e CI workflow off kustomize onto the chart.
• Deletes both kustomize directories.
• Fixes a real bug in the chart's pre-existing validate* template helpers: required/include return their argument on success, and these were included for validation side effects only without discarding the return value — so image.repository/redis.endpoint/the redis port were being injected as literal text into the rendered Deployment YAML (invisible to every existing test, since they all used substring checks; kubeconform catches it immediately).

Verified by actually running task e2e:k8s against a live kind cluster (not just unit tests + helm template), which surfaced three further real regressions, all fixed here:

• baseAgentArgs() (the e2e OIDC-restore test helper) was missing --redis-allow-plaintext, so restoring a pod to the unauthenticated baseline crash-looped it (ADR 0228's fail-closed plaintext-Redis guard).
• The Dex/JWKS-proxy e2e fixture's embedded NetworkPolicies still selected the agent pod with the retired kustomize label (app.kubernetes.io/name: mecatl, plus a part-of label the chart's pod template never carries at all), so they never matched the real chart-rendered agent pod. Corrected to the chart's actual pod labels.
• Once that label fix let those Egress-type policies start matching the agent pod, Kubernetes NetworkPolicy semantics flipped it from unrestricted to deny-except-explicitly-listed for egress, and it lost DNS/API/Redis (the general egress policy the deleted kustomize base used to provide). Added an e2e-fixture-only baseline egress policy (DNS + 443 + Redis) to restore parity — kept out of the chart itself per the decision above.

All 17 specs pass against a real cluster (task e2e:k8s, ~5 min).

Fixes #634

Stack

4th (top) of a 4-PR stack (based on #662):

1. feat(redisstore): support authenticated TLS Redis connections (fixes Store hardening: auth, TLS and snapshot integrity #374)
2. feat(mecak8s): add production Helm deployment baseline
3. feat(mecak8s): add Dex Kind fixture
4. #this — converge kustomize manifests into the Helm chart (fixes Create a set of task targets to deploy mecak8s to kind #634)

Test plan

• go build ./... / go vet ./...
• go test ./deploy/... ./internal/app/... ./internal/deploycheck/...
• task docs:llms && task docs:check
• task deploy:check
• task e2e:k8s against a real kind cluster — all 17 specs pass