feat(helm): add HStore deployment chart

[bitflicker64]

Purpose of the PR

• close [Feature] Add an official Helm chart for distributed HStore deployment #3131

Add an official Helm installation path for the distributed HugeGraph HStore
topology on Kubernetes. The chart packages the PD, Store, and Server startup
contract that otherwise has to be reconstructed by each operator.

This PR is intentionally a draft while its six prerequisite PRs remain open.

Main Changes

• Add the first helm/hugegraph chart with chart version 0.1.0:
  • PD and Store StatefulSets with persistent storage and headless Services.
  • Server Deployment and client Service.
  • PD, Store, and optional Server PodDisruptionBudgets.
  • Optional Server HPA and Ingress.
  • A helm test connection hook.
• Add values.schema.json with render-time validation for replica counts,
  storage, PDBs, HPA, authentication, Services, and other value contracts.
• Add default 3+3+3, single-node, and production-oriented values presets.
• Add scheduling controls, per-component ServiceAccounts with token mounting
  disabled by default, configurable pod security contexts, hardened container
  security defaults, graceful termination periods, probes, and extraEnv.
• Track the latest PD, Store, and Server images while this PR is a draft,
  using pull policy Always so nodes do not retain an older cached image.
• Add Helm lint, render, invalid-value, kubeconform, legacy-values, and
  packaging CI.
• Add chart installation, configuration, upgrade, troubleshooting, and
  limitations documentation, plus a root README installation link.

Distributed startup and recovery contracts

• The chart creates no init Job and does not use HG_SERVER_SKIP_INIT. It sets
  HG_SERVER_INIT_STORE_ENABLED=false, relying on the dedicated
  init_store.enabled gate from PR fix(hugegraph-dist): gate init-store on a dedicated init_store.enabled option #3119 so concurrent Server replicas do not
  initialize the same distributed backend.
• Store waits for PD quorum before starting.
• The image entrypoint retains ownership of PASSWORD handling and
  auth.admin_pa. When required, the chart wrapper only ensures usePD=true
  and the configured PD peers are present before handing control back to the
  image entrypoint.
• Resource names reserve suffix and StatefulSet ordinal space before
  truncation, keeping names valid and PVC identities stable across scaling.
• Server startup allows at least 450 seconds for the image's storage wait and
  startup command.

Prerequisites and draft gate

The chart was tested with the current heads below. These behaviors must be in
the next HugeGraph release source and images before this PR is marked ready.

PR	Tested head	Required behavior
#3105	ee8f5559	Bounded port preflight without lsof
#3119	3e505a81	Dedicated init_store.enabled gate
#3126	35e1a240	Finite JVM DNS cache TTL
#3128	0118e158	One gRPC stub binding per channel
#3129	575a1122	Store readiness retries across PD peers
#3130	26218cb3	Channel and stub refresh after address changes

PR #3126's finite DNS TTL is required for PR #3130 to resolve a replacement
Store address. Neither change provides complete address recovery alone.

Before this PR leaves draft, I will fetch the current master, rebase the
chart, pin appVersion and all three component image tags to the next release,
switch their pull policies to IfNotPresent, verify the merged prerequisite
behavior, rerun the affected full lifecycle matrix, and re-review any resulting
changes.

Verifying these changes

• Trivial rework / code cleanup without any test coverage. (No Need)
• Already covered by existing tests, such as (please modify tests here).
• Need tests and can be verified as follows:
  • Static chart validation: PASS=239 FAIL=0 SKIP=0.
  • Edge-case and hardening suite: PASS=37 FAIL=0.
  • Faithful legacy --reuse-values: helm template and
    helm install --dry-run=client passed.
  • Fresh 3+3+3 install: 9 Ready Pods, zero restarts, cluster 61/0, dataset
    30/0.
  • Same-package upgrade: cluster 61/0, dataset 30/0.
  • Server replacement: PASS=91 FAIL=0.
  • Store replacement: PASS=90 FAIL=0 with data preserved.
  • Deterministic PD REST failover: PASS=7 FAIL=0, with restoration verified.
  • Final cluster and dataset gates: 61/0 and 30/0.
  • Independent review passes 6, 7, and 8 reported no unresolved actionable
    findings on the final template and schema implementation.
  • The subsequent chart-version and default-image metadata amendment changed
    no templates or schema and repeated the full static gate at 239/0/0.

The runtime matrix used a four-node Kubernetes cluster and images built from a
composition containing the exact prerequisite heads listed above. Test-only
validation harnesses and lab-specific low-memory values are excluded from this
PR.

Does this PR potentially affect the following parts?

• Dependencies (add/update license info & regenerate_known_dependencies.sh)
• Modify configurations
• The public API
• Other affects: adds Kubernetes deployment resources and Helm chart CI
• Nope

Documentation Status

• Doc - TODO
• Doc - Done
• Doc - No Need

Documented operational limits

• While this PR is a draft, appVersion and all three component image tags are
  latest. This is intentionally temporary and is not the stable publication
  configuration; the next release tag will be pinned before the PR is marked
  ready.
• Default values intentionally leave resource requests and limits unset;
  values-cluster.yaml is a production starting point, not a capacity
  guarantee.
• The default three-replica PD and Store anti-affinity requires at least three
  schedulable Kubernetes nodes.
• Authentication is optional and disabled by default.
• The published images run as root. The chart hardens the container without
  setting runAsNonRoot or readOnlyRootFilesystem, which the current image
  contract cannot support.
• TLS, backup and restore, an Operator, multi-cluster orchestration, automatic
  leader transfer, ConfigMap-based component configuration, and a complete
  monitoring stack are outside this PR.