fix(helm): add ServiceMonitor support and harden release verification - #37

Summary

Improve Helm monitoring integration and release validation.

Changes

• Add optional Prometheus Operator ServiceMonitor support.
• Add configurable scrape interval, timeout, labels and annotations.
• Add an optional metrics reader binding for secured /metrics endpoints.
• Keep ServiceMonitor discovery and metrics RBAC configuration independent.
• Extend Helm values schema and documentation for the new monitoring options.
• Validate the packaged chart version and appVersion before publishing.
• Verify that artifacthub.io/signKey is present in the packaged chart.
• Verify the chart metadata and provenance again after publishing to GHCR.

Example

metrics:
  enabled: true
  secure: true
  port: 8443

  serviceMonitor:
    enabled: true
    namespace: monitoring
    additionalLabels:
      release: kube-prometheus-stack
    interval: 30s
    scrapeTimeout: 10s

  readerBinding:
    enabled: true
    subjects:
      - kind: ServiceAccount
        name: kube-prometheus-stack-prometheus
        namespace: monitoring