feat: [sc-19068] Support isolated gofer fire-drill sidecars

[devkoriel]

Summary

• add optional extraContainers and extraVolumes to the gofer chart
• add a nullable pod service-account automount override so staging fire-drill workloads can explicitly disable token mounting without changing existing releases
• add a generic pod-extensions chart-testing fixture for the three new pod-spec controls
• fix the existing proxy chart-testing fixture to use the real /healthz endpoint on the healthcheck port
• bump the chart patch version to 0.4.4 and regenerate chart documentation

Safety

• default automount behavior is unchanged because a null value omits the pod field
• no workload or fire-drill scenario is deployed by this chart change
• the generic fixture uses an inert, digest-pinned Kubernetes pause sidecar with non-root, read-only, capability-free settings and bounded resources
• no fire-drill image, namespace, origin, alert, or scenario assertion is committed
• the existing proxy fixture correction remains because standard ct install otherwise fails its liveness and readiness probes with HTTP 404

Local verification

• helm lint charts/gofer
• default helm template render
• generic fixture renders token automount disabled plus an extra container and volume
• Kubernetes 1.29 strict schema validation of the generic rendered fixture
• proxy fixture renders /healthz on the healthcheck port for both probes
• ct lint --config ct.yaml --charts charts/gofer
• git diff --check
• independent code review
• GitHub ct install passes in the ephemeral kind cluster

Dependency

Required by the staging-only sc-19068 workload wiring; this chart PR does not deploy a workload.