fix(helm): harden workload defaults

[kevkantes]

Description

Hardens the Helm defaults surfaced by admission-policy checks and removes the values-type collision around additional resources.

• Replace the list-based extraDeploy contract with the stable-key extraDeployMap contract. This is an intentional breaking change with no compatibility shim.
• Add inherited CPU/memory defaults for MCP servers, OpenFGA hooks, Keycloak reconciliation jobs, and the Milvus components that previously rendered without limits.
• Disable Kubernetes API token automount by default where workloads do not use the API, and add least-privilege security contexts for Keycloak, Milvus, etcd, Neo4j, and the skill scanner.
• Refresh generated chart documentation for the current 0.6.0 release.

Type of Change

• Bugfix
• New Feature
• Breaking Change
• Refactor
• Documentation
• Other (please describe)

Pre-release Helm Charts (Optional)

This PR will use the helm-prerelease label so downstream profiles can validate the published chart before merge.

Validation

• helm lint charts/rag-stack
• helm lint charts/ai-platform-engineering
• Full helm template renders for two map-based deployment profiles
• npm run build in docs/
• git diff --check

Checklist

• I have read the contributing guidelines
• Existing issues have been referenced (where applicable)
• I have verified this change is not present in other open pull requests
• Functionality is documented
• All code style checks pass
• New code contribution is covered by automated tests
• All new and existing tests pass

[github-actions]

✅ No proprietary content detected. This PR is clear for review!

[caipe-io-ci-release]

Prebuild Artifacts for `b18cb07` (archived)

Prebuild Artifacts for b18cb07

Branch: fix/helm-security-defaults
Commit: b18cb07

Helm Charts

Chart	Registry	Version	Status	CI
ai-platform-engineering	ghcr.io/caipe-io/charts	0.6.0-dev.6-chart.1-fix-helm-security-defaults-2	Published	CI
rag-stack	ghcr.io/caipe-io/charts	0.6.0-dev.6-chart.1-fix-helm-security-defaults-2	Published	CI

Helm install commands

helm upgrade --install ai-platform oci://ghcr.io/caipe-io/charts/ai-platform-engineering --version 0.6.0-dev.6-chart.1-fix-helm-security-defaults-2
helm upgrade --install rag oci://ghcr.io/caipe-io/charts/rag-stack --version 0.6.0-dev.6-chart.1-fix-helm-security-defaults-2

These prebuild artifacts will be automatically cleaned up when the PR is closed or merged.

[caipe-io-ci-release]

Prebuild Artifacts for 81ed862

Branch: fix/helm-security-defaults
Commit: 81ed862

Helm Charts

Chart	Registry	Version	Status	CI
ai-platform-engineering	ghcr.io/caipe-io/charts	1.0.0-dev.2-chart.1-fix-helm-security-defaults-2	Published	CI
rag-stack	ghcr.io/caipe-io/charts	1.0.0-dev.2-chart.1-fix-helm-security-defaults-2	Published	CI

Helm install commands

helm upgrade --install ai-platform oci://ghcr.io/caipe-io/charts/ai-platform-engineering --version 1.0.0-dev.2-chart.1-fix-helm-security-defaults-2
helm upgrade --install rag oci://ghcr.io/caipe-io/charts/rag-stack --version 1.0.0-dev.2-chart.1-fix-helm-security-defaults-2

These prebuild artifacts will be automatically cleaned up when the PR is closed or merged.