chore(chart): add values.schema.json to catch typo'd/unknown top-level keys

[VanshikaR7]

Summary

A customer values.yaml (nudgebee-on-prem-test) set a top-level existingPrometheus.url key that doesn't exist anywhere in this chart, so it silently no-oped instead of wiring up OpenCost's Prometheus endpoint. PROMETHEUS_SERVER_ENDPOINT stayed empty and the OpenCost pod crash-looped for days before the misconfiguration was traced back to that key.

This adds charts/nudgebee-agent/values.schema.json — Helm's native JSON-Schema values validation. It whitelists the chart's real top-level keys and sets additionalProperties: false, so helm install/helm upgrade now fails fast and locally with a clear error for any unrecognized top-level key, instead of silently ignoring it.

Nested subchart-owned trees (opencost, opentelemetry-collector, clickhouse, etc.) are left permissive (type: object only) since those are third-party chart values we don't want to have to keep re-syncing as upstream changes.

.github/configs/ct.yaml already has validate-chart-schema: true, so the existing helm-dev-lint.yml / helm-prod-test.yml CI workflows pick this up automatically — no workflow changes needed.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (chart upgrade requires user action)
• Documentation only
• CI / tooling

Note: this is non-breaking for any values.yaml that only uses documented keys. It will start rejecting values files that contain an unrecognized top-level key on their next upgrade to a chart version including this schema — surfacing a pre-existing misconfiguration rather than changing any rendered output.

Chart version

• No version bump needed (version/appVersion in Chart.yaml are set automatically by .github/workflows/release.yaml, per the comment at the top of that file)

Test plan

• Verified schema semantics with a local JSON-Schema validation pass (Python jsonschema, draft-07) since a Helm binary wasn't available in this environment:
  • Default charts/nudgebee-agent/values.yaml validates cleanly against the new schema.
  • Adding the exact existingPrometheus.url key from the incident is correctly rejected: Additional properties are not allowed ('existingPrometheus' was unexpected).
• helm lint charts/nudgebee-agent / ct lint (should be exercised by CI on this PR)
• helm template output reviewed — unaffected, this change adds no templates

Related issues

Follow-up from the nudgebee-on-prem-test OpenCost disconnection investigation (Slack thread, not a tracked GitHub issue).

---

Generated by Claude Code

[gemini-code-assist]

Code Review

This pull request introduces a JSON schema (values.schema.json) for the nudgebee-agent Helm chart to validate top-level configuration values. The reviewer pointed out that because additionalProperties is set to false, the schema will reject the standard Helm global key, which is commonly used to pass values to subcharts. They suggested adding global to the allowed properties to prevent validation failures.

[gemini-code-assist]

Since additionalProperties: false is set, any top-level keys not explicitly defined in this schema will cause validation to fail. Helm reserves the global key for passing values to all charts (including subcharts like clickhouse or opentelemetry-collector, which often rely on global for shared settings like image registries or pull secrets).

To prevent validation failures when users specify global values, please add the global key to the schema properties.

    "clickhouse": { "type": "object" },
    "alertmanager": { "type": "object" },
    "global": { "type": "object" }