fix(chiefonboarding): align template standards

[mberlofa]

Summary

• add the canonical chiefonboarding.validate helper and validate.yaml gate
• fail fast for incomplete external PostgreSQL, missing ingress rules, and selector label overrides
• preserve hostless catch-all Ingress support by omitting spec.rules[].host when not configured
• add helm-unittest coverage for validation paths and catch-all Ingress rendering

Validation

• make template-standards-check CHART=chiefonboarding
• helm unittest charts/chiefonboarding
• helm lint --strict charts/chiefonboarding
• make standards-check CHART=chiefonboarding
• make validate-chart CHART=chiefonboarding TIMEOUT=1200: FULLY VALIDATED (13 layers)
• make site-sync-check CHART=chiefonboarding
• make release-check REPO=charts
• make attribution-check REPO=charts

Site PR: helmforgedev/site#331
Issue: #633

Summary by CodeRabbit

• Bug Fixes
  • Ingress rules now omit the host field when no host is provided, enabling catch-all routing.
• New Features
  • Added render-time validation for external database settings, ingress host configuration, and podLabels to prevent selector label overrides.
• Tests
  • Added tests for catch-all ingress rendering and for the expected validation failure messages under misconfiguration.

[github-actions]

Standards Check (GR-079) — PASS

Every changed chart fully passes standards-check.

[github-actions]

🟢 Security Scan: chiefonboarding

Framework	Score
MITRE + NSA + SOC2	83.333336%

✅ Security posture acceptable.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds render-time chart validation for database, ingress, and pod label settings, wires it through a new validate template, and updates ingress rules so host fields are omitted when unset. It also adds tests for the validation failures and the hostless ingress case.

Changes

Chart validation and ingress host handling

Layer / File(s)	Summary
Validation helper template and wiring charts/chiefonboarding/templates/_helpers.tpl, charts/chiefonboarding/templates/validate.yaml, charts/chiefonboarding/tests/validation_test.yaml	Adds chiefonboarding.validate checks for external database and ingress values plus selector label overrides, renders it from validate.yaml, and covers the validation cases in tests.
Conditional ingress host rendering charts/chiefonboarding/templates/ingress.yaml, charts/chiefonboarding/tests/ingress_test.yaml	Makes ingress rule host rendering conditional on .host being present and adds a test that asserts host is omitted for catch-all paths.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the PR’s main goal of bringing the chiefonboarding chart into template-standard compliance.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/chiefonboarding-template-standards

---

_{Comment @coderabbitai help to get the list of available commands.}