Reach: EKS add-on delivery for the Signals Helm chart

[fheikens]

Part of #233. Inherits the cross-cutting decisions from #233 (read it; do not
duplicate here).

What

Offer the existing Signals Helm chart as an Amazon EKS add-on, so it is
discoverable and installable directly from the EKS console / eksctl add-on
flow — same artifact, native EKS-console reach.

Why

Pure reach within our existing (EKS) audience: no new deploy target, reuses the
already-re-hosted chart + image. Lower conceptual distance than ECS or AMI.

Scope

• Package/register the chart as an EKS add-on per AWS Marketplace + EKS add-on
  requirements.
• Verify the add-on install path against the same values contract the Helm
  delivery uses.
• One AWS review round.

Acceptance criteria

• Signals appears as an installable EKS add-on sourced from the Marketplace.
• Add-on install produces the same running collector as the Helm delivery.

Gate

Decision gated on #233.

[fheikens]

Pre-submit smoke — PASS to the pre-publication ceiling. 2026-07-02.

• helm lint clean.
• INV-EAO-01 confirmed: the chart deploys ghcr.io/elevarq/signals:1.0.0 — the exact image validated in Reach: add container-image delivery option (ECS / Fargate / docker pull) #234 — with runAsNonRoot / runAsUser: 10001 / readOnlyRootFilesystem.
• Real chart install on Kubernetes (docker-desktop, isolated namespace): pod Ready, uid=10001(signals), target_count: 1, snapshot_count: 1 after collect now. The chart the EKS add-on wraps installs and runs the same collector.

By-construction caveat: the true aws eks create-addon catalog path (TC-EAO-05) can only be exercised once the add-on is published to Limited visibility — it is a post-submit smoke, unreachable pre-submit.

Incidental finding: the collector fail-closes on sslmode=disable unless SIGNALS_ALLOW_INSECURE_PG_TLS=true (correct hardening — real EKS targets use RDS verify-full; only relevant for the non-TLS local smoke target).

Also surfaced a defect in the #235 AMI groundwork (wrong ghcr slug in the Image Builder component default) — tracked as #240.