Add opt-in idle sleep and wake to the Helm chart

[nicosuave]

Add opt-in idleScale to the Helm chart with a default 3,000-second (50-minute) idle timeout. A small, always-on TCP proxy wakes a zero/one query worker for PostgreSQL or Flight and forwards TLS/authentication unchanged. Open connections and core-owned sessions, queries, tickets, transactions, response streams, and cleanup prevent automatic sleep.

Use authenticated control probes, scoped proxy RBAC, and a worker NetworkPolicy. Fence Kubernetes writes by resource version before worker reuse so delayed scale-down requests cannot race recovery or a new wake. Preserve idle-mode replica state across Helm upgrades and reject enabling it on live normal-mode workers.

Pin the released core v0.1.13, built from merged core runtime PR #235, for all four Linux/macOS platforms. Update the image's checksum-pinned binary license to the same release. Add the real idle cycle to Helm CI and native-host SIGPIPE/cancellation regressions to both Docker architecture jobs.

Validation passed locally:

• Four-platform payload architecture, dependency, private-path, exported ABI and actual load checks; all six published assets independently downloaded without authentication and checksum-verified.
• Production-default Docker image built from the published lock; real SQLAlchemy, PostgreSQL and GizmoSQL ADBC/Flight tests, including 24 explicit cancellations and 24 abandoned streams with successful follow-up queries under default native SIGPIPE policy.
• Disposable k3s with the published-payload image: TLS PostgreSQL and Flight cold wake, retained session/ticket and active stream protection beyond the idle interval, sleep after cleanup, and repeated wake from zero.
• 8 core idle tests, 8 runtime regressions, 5 proxy tests, 6 chart tests (16 subtests), strict opt-in Helm lint, workspace Clippy with warnings denied, Rust format and Python lint/format.

No production deployment was performed.