feat(helm): support custom CA certificates

[gavinelder]

Summary

• add global.trustStore support for inline CA bundles and existing ConfigMaps or Secrets
• preserve public trust for JVM, Python/Go/OpenSSL, and Node.js workloads while adding private CA certificates
• import every certificate from multi-certificate PEM bundles into generated Java trust stores
• wire Platform, cron, Wave, Agent Backend, MCP, Pipeline Optimization, and Portal Web
• add documentation, examples, chart releases, generated schemas, and regression coverage

Validation

• pre-commit Helm docs and schema generation
• Helm formatting and changelog checks
• full Helm chart test suite: 1,318 tests passed
• all standalone subchart test suites passed
• helm lint charts/platform
• verified two certificates from one PEM bundle are imported under separate Java trust-store aliases