feat(spire,spectre): support secret-backed env vars via env.raw

[devkoriel]

Why

Neither chart can pass a secret to its container. helpers.list-env-variables renders only .Values.env.normal, which inlines every value as plain text, and there is no envFrom or secretKeyRef path anywhere in either deployment template.

That blocks RFC-036: the NATS transport needs CFG_NATS_TOKEN, which comes from Vault and cannot be committed to app-of-apps. Today 24 spectre relays and 4 spire deployments in staging simply cannot receive it.

What

Adds the env.raw passthrough that the validator chart already uses (charts/validator/templates/deployment.yaml:155 and deployment-vao.yaml:139), so the three Chronicle app charts behave consistently:

### -- ADDITIONAL ENV VARS FROM `.Values.env.raw`
{{- if .Values.env.raw }}
  {{- toYaml .Values.env.raw | nindent 12 }}
{{- end }}

spire 0.3.5 → 0.3.6, spectre 0.3.7 → 0.3.8. READMEs regenerated with helm-docs (only these two charts; helm-docs also wanted to rewrite nine unrelated chart READMEs from pre-existing drift, and I reverted those to keep this diff honest).

Backwards compatibility

env.raw defaults to [] and the block is skipped when unset, so output is byte-identical for every current consumer. Verified by rendering both charts with default values: spire still emits 0 env vars, spectre still emits its usual 7.

With the key set, both charts render the secret reference correctly alongside env.normal:

- name: CFG_NATS_ENABLE
  value: "true"
- name: CFG_NATS_TOKEN
  valueFrom:
    secretKeyRef:
      name: stage-nats-auth
      key: token

Usage after release

app-of-apps wires CFG_NATS_TOKEN into the spire and relay appsets, sourced from the same Vault key the stage-nats server authenticates against. That PR follows once these versions are published, since it needs the targetRevision bumps.