ci: render charts with their ci/*-values.yaml fixtures in lint and kubeconform

[andrey-embarklabs]

The helm template + kubeconform step renders each chart with no values file (helm template ci "${chart}"). That works until a chart adds a render-time required guard on a credential. PR #21 adds exactly such a guard (cnpg.cluster.credentials.password is required) and ships helm/xnat/ci/default-values.yaml to satisfy it, but the workflow never loads that fixture, so the render fails:

Error: execution error at (xnat/templates/statefulset.yaml:23:28):
cnpg.cluster.credentials.password is required: ...

(helm lint passes because it does not hard-fail on required; only the kubeconform render does.)

This loads each chart's ci/*-values.yaml fixtures (the chart-testing convention) in both the lint and template/kubeconform steps, falling back to default values when a chart has no fixture. Charts without a fixture render exactly as before.

Verified with the CI-pinned toolchain (helm, kubeconform v0.7.0, actionlint 1.7.7 + shellcheck --severity=error):

• feat(chart): security and credential hardening #21's chart (guard + fixture): renders and validates across Kubernetes 1.27 / 1.29 / 1.31 / 1.33 (27 valid, 0 invalid).
• A chart with no fixture: still renders defaults, exit 0.
• actionlint on the workflow: clean.

Note on ordering: merge this before #21. Once #21's guard is on main, the chart-lint push run on main needs this fixture-loading to stay green.

[kathrynalpert]

Fixtures are matched by ci/*-values.yaml, would this be true for all relevant files, or do we need to document the expectation?