feat: add Helm chart for installing the operator

[monolith-james]

Summary

Adds the project's first Helm chart, at deploy/charts/marimo-operator/, alongside the existing deploy/install.yaml and kustomize install paths. It installs the operator (CRD + controller + RBAC) as a configurable, versionable package; it complements the existing methods rather than replacing them.

Chart

• Installs the MarimoNotebook CRD, controller Deployment, ServiceAccount, manager/leader-election/metrics RBAC, and the metrics Service.
• Configurable image/tag, resources, replicas, namespace (release namespace — nothing hardcoded), leader election, metrics, the operator-managed images (DEFAULT_INIT_IMAGE/GIT_IMAGE/ALPINE_IMAGE/S3FS_IMAGE), scheduling, security contexts, and extraArgs/extraEnv.
• ServiceMonitor and metrics NetworkPolicy are optional and off by default (mirrors the commented-out kustomize components). No webhooks today → no cert-manager dependency.

CRD handling

• Ships in the chart's crds/ directory. make manifests now also copies the generated CRD into the chart, and a CI job fails on drift — so the Go API types stay the single source of truth.

CI

• New .github/workflows/helm.yml: helm lint, helm template, and the CRD-drift guard.
• .pre-commit-config.yaml: scoped check-yaml to exclude deploy/charts/**/templates/ (Helm templates aren't valid standalone YAML); all other files still checked.

Verification

• helm lint passes; helm template matches kustomize build config/default resource-for-resource (only intentional diffs: no Namespace object — release namespace is used — and the image defaults to the v0.3.0 release tag rather than :main). Toggles verified; full render passes kubectl apply --dry-run. make lint and make test pass locally.

A few open questions

• Publishing — I left out a chart-publishing workflow on purpose; how you publish and version charts is your call. Happy to wire it up however you'd like.
• Chart.yaml metadata — maintainers and icon are placeholders; let me know what you want there.

Checklist

• Any AI-generated code has been reviewed line-by-line by the human PR author.
• Tests added/updated where applicable — chart helm lint/template + CRD-drift CI (.github/workflows/helm.yml).
• make lint and make test pass locally (operator).
• uv run pytest / ty check kubectl_marimo (plugin) — N/A, no plugin changes.
• If CRD fields changed, make manifests run and generated files committed — CRD fields unchanged; chart copies the existing generated CRD.
• Documentation updated — root README.md (Helm install), CONTRIBUTING.md (CRD sync), chart README.md.