mecak8s chart: close remaining production operational hardening gaps

[ChrisJBurns]

Problem

Several remaining operational hardening requirements are implicit or external:

• Environment-backed provider, learning-store, and MCP Secrets do not rotate in running pods and do not trigger rollouts.
• Offline/GitOps rendering generates a random telemetry installation UUID, producing perpetual diffs unless operators set it explicitly.
• Chart.yaml declares no supported kubeVersion, despite version-sensitive fields and policy/v1 resources.
• The raw-driver NetworkPolicy is namespace-global and trusts spoofable component labels rather than a strong workload identity.
• The chart lacks standard release metadata/labels and packages development test fixtures.

Proposed direction

Make the operator contracts explicit and machine-checkable where possible: provide credential rotation/rollout integration, deterministic GitOps identity, a tested Kubernetes version range, release-scoped policy selectors plus documented admission/namespace requirements, and conventional Helm metadata/packaging hygiene.

Acceptance criteria

• Every environment-backed Secret has a documented and tested rotation path.
• Identical offline renders are deterministic or fail with an actionable requirement.
• Supported Kubernetes versions are declared and tested in CI.
• Installing/uninstalling one release does not change another release's raw-driver policy.
• Security documentation does not present label selection alone as a tenant identity boundary.
• Published chart metadata reports the application version and excludes development-only files.