[blairhoddinott]

Summary

• add a portable Helm chart for deploying EdenText to Kubernetes
• run the bundled nginx image as a restricted, non-root workload on an unprivileged port
• support optional Ingress/TLS, immutable image digests, probes, resources and scheduling settings
• validate values with JSON Schema and test rendering on Helm 3 and Helm 4
• validate rendered Kubernetes resources with kubeconform in CI

EdenText remains fully client-side. The chart creates no database or persistent volume.

Test plan

• bash scripts/test-helm-chart.sh with Helm 3.22.1
• bash scripts/test-helm-chart.sh with Helm 4.3.1
• kubeconform 0.8.0 against default, ingress-enabled and digest-pinned renders
• restricted container smoke test as UID/GID 101 with a read-only root filesystem and all capabilities dropped
• npm run check
• npm test — 1,960 passed, 30 skipped

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[blairhoddinott]

I have read the CLA Document and I hereby sign the CLA