Add pre-install/upgrade environment verification script and docs

[Madias2222]

Summary

Adds an automated pre-flight check that validates a cluster before helm install / helm upgrade of the IAP chart, so environment problems surface in seconds instead of as failed installs, crash-looping pods, or silently broken TLS.

• scripts/precheck.py — portable Python 3 (standard library only) tool. Shells out to the kubectl and openssl binaries operators already have — no pip install required — and runs on Linux, macOS, and Windows.
• docs/pre-install-verification.md — documents every assertion, the available flags, and the manual kubectl equivalent of each check.
• README.md — new Pre-Install / Pre-Upgrade Verification subsection under Requirements & Dependencies, linking the doc.

What it verifies (23 checks, 3 groups)

Group	Checks	Covers
Secrets	8	itential-platform-secrets exists/Opaque, 6 required keys present & non-empty, image pull secret, CA secret
Persistent Volumes	6	StorageClass + provisioner, no stale PVCs; (upgrade) PVCs exist, Bound, on expected StorageClass
cert-manager / TLS	9	CRDs, pods, components, Issuer ready & CA ref; (upgrade) Certificate ready, TLS secret keys, expiry & SAN coverage

Checks marked (upgrade) run only in upgrade mode. Reports PASS / FAIL / WARN; a name that can't be resolved is WARN (skipped), never a false FAIL.

Design notes

• Zero editing for customers — environment-specific names (namespace, StorageClass, issuer, secrets) are read from the values file passed with -f; any value can be overridden with a flag. PyYAML is optional (only needed to read the values file); without it, pass names via flags.
• CI-ready — exits non-zero on any failure, so it can gate an install in a pipeline.
• Self-guarding — a built-in --self-test mode (no cluster needed) locks the resource-name derivation to the chart's _helpers.tpl / StatefulSet templates so it can't silently drift.

Usage

# Before a first install:
python3 scripts/precheck.py install -n <namespace> -f <values-file>

# Before an upgrade (adds PVC + certificate health checks):
python3 scripts/precheck.py upgrade -n <namespace> -f <values-file>

# Sanity-check the tool itself, no cluster needed:
python3 scripts/precheck.py --self-test

Testing

- --self-test passes (15/15) in the committed branch.
- Verified end-to-end runs (install / upgrade), graceful WARN degradation when names are unresolved, and non-zero exit on failure.

**Heads-up on the base branch:** `precheck` is branched off `main`. If you open the PR against **`upstream/main`** (`itential/iap-helm`), note the doc/README use the example values `md` / `values-perflab.yaml` / `longhorn` / `itential-ca` — fine as illustrative examples, but flag them if the upstream maintainers prefer neutral placeholders. Against your own fork's `main`, no concern.