feat(chart): enable Edge v3.6.0 features and pin to v3.6.0 (chart 0.6.0)

[alextoulps]

Activates the merged Edge v3.6.0 features that are inert without chart changes, then pins the chart to that release and publishes it as chart 0.6.0.

has_endpoints (edge#112 / brain#1118)

• Add endpoints to config.kube.resources (informer gate — config.json overrides the binary's compiled default).
• Add endpoints (get/list/watch) to the ClusterRole in templates/rbac.yaml (RBAC gate).

Without both, getEndpointsPresence is RBAC-denied → has_endpoints stays nil → brain treats it as unknown and never flags selector/reachability faults (safe, but inert).

ConfigMap capture (edge#117 / brain#1151)

• Expose config.configMapCapture (clearText / redactKeyPatterns / captureCap) so the hash-by-default + opt-in clear-text policy is configurable.

Pin to Edge v3.6.0 (added after initial review)

• values.yaml — image.tag: "latest" → "v3.6.0". This is the load-bearing edit; edge-proxy inherits it via nofire-edge.edgeProxy.image, so one value pins both deployments.
• Chart.yaml — version: 0.5.2 → 0.6.0, appVersion: "2.1.0" → "v3.6.0".
• examples/production-values.yaml — pinned; it previously overrode the default straight back to a floating tag.
• manifests.yaml — pinned for consistency. Note this is the standalone raw manifest, outside the chart render path, so it isn't part of the pin proper.

Three things worth a reviewer's attention:

The chart has never pinned a version. image.tag has been "latest" since the repo was created, and appVersion sat at a stale 2.1.0 that only ever reached the app.kubernetes.io/version label. So this is floating → pinned, a behavior change for every consumer, not a routine bump. Anyone who relied on latest to auto-track Edge releases now needs a chart upgrade per release — that's the intent, but it's a change.

The tag carries a v. edge/.github/workflows/release.yml computes version=${GITHUB_REF#refs/tags/}, which strips refs/tags/ but not the v. The registry has nofireai/edge:v3.6.0 and nofireai/edge-proxy:v3.6.0 (both published 2026-08-10); there is no bare 3.6.0 tag in either repo. appVersion is set to the same v-prefixed string so the tag | default .Chart.AppVersion fallback stays resolvable if anyone clears image.tag — this deviates from the bare-semver form used in c580052, deliberately.

The Chart.yaml bump is mandatory, not cosmetic. The release workflow triggers only on paths: ['Chart.yaml'] and skips every publish step when a release for the current version already exists. As originally scoped, this PR touched no Chart.yaml and so would have merged and shipped nothing. 0.6.0 is free (gh release list shows only nofire-edge-0.5.2); minor rather than patch matches the repo's feature convention (0.4.0 → 0.5.0, 0.3.0 → 0.4.0).

pullPolicy stays Always so overriding the tag back to latest still behaves.

Testing

• helm lint . — passes (only the pre-existing "icon is recommended" info).
• helm template t . --set edgeProxy.enabled=true renders exactly nofireai/edge:v3.6.0 and nofireai/edge-proxy:v3.6.0.
• helm template t . --set image.tag="" exercises the appVersion fallback and also renders v3.6.0, i.e. resolvable rather than ImagePullBackOff.
• app.kubernetes.io/version label confirmed off 2.1.0.
• No latest left in values.yaml, examples/, or manifests.yaml.
• Both images verified present on Docker Hub.

Note this repo has no PR-triggered CI — release.yml fires on push-to-main and workflow_dispatch only, so no checks will report here. On merge it should create release nofire-edge-0.6.0 and update gh-pages/index.yaml.

---

Refs NOFireAI/engineering#799, NOFireAI/engineering#811
Refs NOFireAI/edge@v3.6.0 · changelog entry in NOFireAI/docs#30