Publish an OCI Helm chart as the install path for this fork

[jacaudi]

Problem

This fork has no install artifact. There is no chart directory in the repo, jacaudi/charts does not exist, and jacaudi/wireguard-operator has published zero GitHub Releases — only the v2.11.0 boundary tag created to bound release-please's commit scan.

Until #36, the README papered over this by pointing at upstream's artifacts:

kubectl apply -f https://github.com/nccloud/wireguard-operator/releases/download/v2.11.0/release.yaml
helm repo add nccloud https://nccloud.github.io/charts
helm install wireguard nccloud/wireguard-operator -n wireguard-system

Those commands install the diverging upstream operator, which does not contain this fork's features (spec.persistentKeepalive, for example). #36 removed them — correctly, but that leaves the README with no copy-paste install path at all. make deploy from source is the only documented route today.

Proposal

Publish an OCI Helm chart for this fork, and make it the documented install path.

Sketch of the target UX:

helm install wireguard \
  oci://ghcr.io/jacaudi/wireguard-operator/charts/wireguard-operator \
  -n wireguard-system --create-namespace

Scope

• Add a chart to the repo (path and structure TBD — charts/wireguard-operator/ is the conventional choice)
• Decide the chart's relationship to release.yaml and config/. The repo already has a drift gate (hack/release-file-drift.sh) keeping release.yaml in sync with config/; a chart is a third rendering of the same knowledge and needs the same treatment or it will drift silently
• Chart must expose both images — ghcr.io/jacaudi/wireguard-operator/manager and .../agent. The manager consumes the agent image at runtime via --agent-image=, so the two versions must move together
• Wire chart publish into the release pipeline. jacaudi/template models a chart stage (has_chart), currently answered false for this repo — flipping it is likely the cleanest route, but the template publishes one image and this repo publishes two, so verify rather than assume
• Update the README deploy/remove sections to the OCI commands
• Cut an actual GitHub Release so a versioned artifact exists (release-please is live; PR chore: release main #47 is on hold)

Notes

• The API group stays vpn.wireguard-operator.io — decided in [P6] Fork housekeeping: Go module path #36, documented in docs/ROADMAP.md § 6.2. The chart must not attempt to rename it.
• has_chart=false is the current copier answer; changing it means a copier update pass.

Refs #36, #37.