feat(helm): the Postgres connection string from a Secret (kagent-dev/substrate#32) and atelet scheduling knobs

[teemow]

Problem

Meta chart 4.0 ships Substrate inside the agent-platform chart (components.substrate / components.substrate-crds). Two things the Substrate chart cannot express today:

• The connection string of an external PostgreSQL only as a value. The platform puts Substrate's control-plane database on its CNPG cluster, which hands out the DSN in a Secret. The chart takes postgres.connectionString as a plain value and writes it into the ate-api-server-envvars ConfigMap — credentials in a ConfigMap, and a Secret that has to be copied into values first.
• No scheduling knob on atelet. The platform runs atelet on its worker nodes / node pools; the atelet DaemonSet renders no nodeSelector, tolerations or affinity.

Solution — upstream first

1. git cherry-pick -x of Support PostgreSQL connection secrets kagent-dev/substrate#32 "Support PostgreSQL connection secrets" (open, by iplay88keys) — both commits of the pull-request branch, unchanged, with the upstream author and the (cherry picked from commit …) trailers:
   • 1872249e → 42c0c6b8: postgres.connectionStringSecretRef.{enabled,name,key}; the substrate.postgres.connectionStringSecretEnabled helper; two guards (connectionString and connectionStringSecretRef are mutually exclusive; one of them is required when postgres.enabled=false); ate-api-server reads ATE_API_POSTGRES_CONNECTION_STRING from a secretKeyRef (defaults <release>-postgres-connection / connectionString) and the ConfigMap omits it in Secret mode; README row; charts/substrate/tests/postgres_test.yaml; the helm-test Makefile target and the helm-e2e step that runs helm-unittest.
   • 41097da7 → 392841e2: helm plugin install … --verify=false in that step — without it the helm-e2e job fails on Helm 4 (the reason the upstream PR carries the follow-up).
     Every hunk applied cleanly; nothing was dropped. The patch falls away at the re-pin onto the first upstream release that carries it.
2. One commit of ours, upstream-ready (d9717d78): feat(helm): atelet DaemonSet takes nodeSelector, tolerations and affinity — atelet.nodeSelector: {}, atelet.tolerations: [], atelet.affinity: {}, rendered in the DaemonSet pod spec next to serviceAccountName; README rows; charts/substrate/tests/atelet_test.yaml. Upstream has no focused change for this: Add configurable nodeSelector to substrate workloads kagent-dev/substrate#16 adds atelet.nodeSelector (no tolerations or affinity) inside a 92-file fork-wide pull request that has been conflicting since July; ours is the minimal knob. The upstream-shaped patch is branch upstream/atelet-scheduling in this repository (b34c1690, on the mirror main, default render identical there too); it is opened against kagent-dev/substrate after review in giantswarm/giantswarm#37742, not before.
3. Ledger: the last commit adds the two rows to the "Carried patches" table of FORK.md and points the meta-chart consumer row at 4.0.

Verification

• Default render (helm template s charts/substrate) byte-identical before and after each patch; make verify-helm-template passes (manifests/ate-install/ unchanged).
• Secret mode: helm template s charts/substrate --set postgres.enabled=false --set postgres.connectionStringSecretRef.name=x --set postgres.connectionStringSecretRef.key=uri renders the ate-api-server env ATE_API_POSTGRES_CONNECTION_STRING from secretKeyRef {name: x, key: uri} and a ConfigMap that carries only ATE_API_POSTGRES_SCHEMA.
• helm unittest charts/substrate (helm-unittest 1.0.3, Helm 4.2.2): 2 suites, 11 tests pass; hack/util/verify-boilerplate.py and helm lint clean.
• CI on this PR: run-tests, govulncheck, helm-e2e (which now runs make helm-test as well).

Merge

Rebase-merge (gh pr merge --rebase): the commits land as they are — the two cherry-picks keep their trailers so the next re-pin drops them by itself, and the atelet commit is the one upstream gets.

Refs giantswarm/agent-platform#342