Add Docker image and Helm chart for Kubernetes deployment

[gustcol]

Summary

• Add multi-stage Dockerfile for the Python components (gcm + health_checks) with multi-platform support (linux/amd64, linux/arm64)
• Add Helm chart (deploy/helm/gcm/) with DaemonSet for monitoring collectors and CronJob for periodic health checks
• Add CI workflow for Docker build validation and Helm lint across platforms

Security hardening

• Non-root container execution (UID 65532)
• Read-only root filesystem with emptyDir for /tmp
• All Linux capabilities dropped (drop: ALL)
• allowPrivilegeEscalation: false enforced
• No shell login for runtime user

Test plan

• helm lint deploy/helm/gcm passes
• helm template renders valid Kubernetes manifests with all security contexts
• Helm test pod validates both gcm --help and health_checks --help entry points
• Docker build on linux/amd64 and linux/arm64 via CI
• Deploy to a test Kubernetes cluster with Slurm nodes

[github-actions]

CI Commands

The following CI workflows run automatically on every push and pull request:

Workflow	What it runs
GPU Cluster Monitoring Python CI	lint, tests, typecheck, format, deb build, pyoxidizer builds
Go packages CI	shelper tests, format, lint

---

The following commands can be used by maintainers to trigger additional tests that require access to secrets:

Command	Description	Requires approval?
/metaci tests	Runs Meta internal integration tests (pytest)	Yes — a maintainer must trigger the command and approve the deployment request
/metaci integration tests	Same as above (alias)	Yes

Note: Only repository maintainers (OWNER association) can trigger /metaci commands. After commenting the command, a maintainer must also navigate to the Actions tab and approve the deployment to the graph-api-access environment before the jobs will run. See the approval guidelines for what to approve or reject.