fix: heap sizing and signing policy changes without a CA restart (#592, #588)

[slauger]

Two fixes, one commit each.

#592 -- javaArgs default made the heap derivation dead code

resolveJavaArgs sizes the JVM heap at 90 percent of the pod's memory limit when javaArgs is unset. The CRD default made that unreachable: the field was never empty, so every Server ran with -Xms512m -Xmx1024m regardless of its limit. A Server given 8Gi used 1Gi of it.

Third instance of one mistake after #550 (image repository/tag) and #576 (pullPolicy). A default removes the empty state a fallback depends on, so it belongs in the chart where it is visible rather than in the CRD where it disables code.

Worth noting how it survived: three unit tests already covered resolveJavaArgs, including the memory-derived branch, and all passed. They call the function directly and so prove nothing about whether the field can be empty in a real cluster. Replaced them with a round-trip through the API server, which fails against the old CRD and names the materialised value:

javaArgs must come back empty so the heap can be derived, got "-Xms512m -Xmx1024m"

This also restores the auto-tuning statement in the README and feature list, which I had corrected in #591 to match the broken behaviour rather than the intended one.

Upgrade note: existing Servers carry javaArgs materialised from the old default and keep it until the field is cleared. A helm upgrade clears it; hand-written resources need it removed.

#588 -- policy edits restarted the CA

The policy Secret was mounted with SubPath, which the kubelet never refreshes, so the operator compensated with a hash annotation on the pod template. With the CA Deployment on the Recreate strategy, every SigningPolicy edit meant a short outage -- no signing, no CRL -- for a change that alters no running state.

Nothing downstream needed it: openvox-autosign is executed per CSR and reads the file each time. Only the mount did.

Now mounted as a directory, the way the CRL Secret already is for the same reason, with the file passed via --config. The hash annotation is gone.

Trade-off: a change takes effect within the kubelet sync period, up to about a minute, instead of immediately after a restart. For a rule deciding which CSRs get signed, that is the better end of the trade -- and it is stated in the concept page rather than left as a surprise.

Test changes

The old test asserted the annotation exists. It now asserts the opposite and that the mount carries no SubPath, since reintroducing one would silently bring the whole problem back. The rendered puppet.conf is checked for the config path as well: a wrong path denies every CSR and would otherwise surface only in an end-to-end run.

Verification

make test (with envtest), make manifests and golangci-lint 2.13.2 are clean. The autosign-policy e2e scenario exercises the new mount path end to end.

Closes #592
Closes #588