[justgithubaccount]

Summary

• make ServiceAccount creation and existing-account selection consistent and fail closed on an incomplete existing-account configuration
• consume createInternalSecret when enabled, and document the external Postgres value as DNS-only with explicit DATABASE_URL ownership
• require host values for enabled ingress/external Postgres modes and add positive/negative rendering matrices
• replace the stale chart description and validate the current read-only GitOps consumer layering

Validation

• helm lint passed
• every matrix render parsed as Kubernetes YAML and passed kubeconform
• ServiceAccount, internal Secret, external Postgres, ingress, namespace, and invalid-input cases passed
• default rendered resources are byte-identical to main: sha256 eccee8f126eec4287d1ccf664414f73632b70a6dfa46357b8c31f7d54e96637f
• current app-poly-gitops-k8s main consumer pin v0.4.1 and dev values rendered successfully
• actionlint passed

No chart publish, Kubernetes change, release, deployment, or cloud operation was run.

Refs justgithubaccount/app-poly-gitops-infra#30
Refs justgithubaccount/app-poly-gitops-infra#27