feat: allow sidecars to set their own env vars and secret env

[piotrlaczykowski]

Problem

Sidecar containers could only inherit the release-wide envVars / envVarsFromSecret. There was no way to give a sidecar an env var of its own, or to give it a different value for one the main container already sets.

Change

Each sidecars[] entry now accepts:

• envVars — plain env vars, same shape as the top-level key
• envVarsFromSecret — map rendered into a per-sidecar Secret named <fullname>-<sidecar>-secret-env

Both merge on top of the release-wide values, and the sidecar's value wins on a name collision. Two Kubernetes precedence rules carry that:

• the sidecar's secretRef is listed last in envFrom, and for duplicate keys the last source wins;
• container env always beats envFrom — so a release-wide envVars entry whose name the sidecar sources from its own Secret is dropped from the rendered env list, otherwise it would shadow the Secret value.

Sidecars with no env keys of their own render exactly as before.

envVars:
  - name: foo
    value: bar
envVarsFromSecret:
  secretKey: secretValue

sidecars:
  - name: proxy
    enabled: true
    envVars:
      - name: foo          # overrides the release-wide foo
        value: sidecar-bar
      - name: PROXY_MODE   # sidecar-only
        value: transparent
    envVarsFromSecret:
      secretKey: sidecarSecretValue   # overrides the release-wide key

Files

• _deployment.yaml — sidecar env / envFrom rendering
• _helpers.tpl — secret-sidecar-env-name and the sidecar.env merge helper
• _secret-env.tpl + _deployment-global.tpl — per-sidecar env Secret
• values.yaml — documents the two new sidecar keys and the override rule
• test-template chart — exercises override, sidecar-only, and secret-override cases
• READMEs / skill resources — regenerated (helm-docs + skill generators)

Verification

• helm lint + helm template on the test-template chart, output inspected for all three cases (override, sidecar-only, multiple sidecars each with their own Secret)
• pre-commit run --all-files — passes
• npm test — 40/40 pass