feat: deploy DiceBear avatar renderer via the bundle

[marians]

Wires the giantswarm/dicebear chart into the meta-package as a force-enabled component, so the self-hosted DiceBear avatar API is deployed on every cluster that runs the platform. Resolves the open "chart home" decision in the agent-avatar-icon PRD — part of the bundle.

Context: giantswarm/giantswarm#37211.

What changed

• values.yaml — components.dicebear (versionRange: "0.x", injectGlobal: false — the chart's strict schema consumes registry.domain, not global; force-enabled like muster/connectivity) + a forwarded top-level dicebear: block.
• examples/customer-bom.yaml — pin dicebear: 0.3.0 (required; verify-meta rejects unpinned ranges).
• values.schema.json — document the dicebear pass-through block and its route sub-keys.
• Makefile.custom.mk — verify-meta asserts the component renders.
• README.md / CHANGELOG.md.

No changes to the dicebear chart — it already ships the workload, the public HTTPRoute, and the Envoy HTTPRouteFilter that does the path→query rewrite.

Per-cluster requirement

The public avatar route is on by default, so every installation must set dicebear.route.parentRefs (typically the same public Gateway as ingress.parentRefs) and dicebear.route.hostnames (e.g. avatars.<domain>) via its gitops overlay — the chart hard-fails otherwise, by design, matching the existing ingress.* contract.

Runtime prerequisite (dicebear repo, not this PR)

The chart pins image.tag: "4.9" while retagger mirrors docker.io/dicebear/api with semver: ">= 4.9.0". Confirm a 4.9 tag actually lands in gsoci.azurecr.io/giantswarm/dicebear-api, or pods won't pull.

Verification

• helm template renders the dicebear OCIRepository + HelmRelease with route.enabled: true (flux and argo).
• make verify-meta (incl. new assertion + BOM-pin guard) and make verify-modes pass.
• helm lint passes; default values validate against the schema.
• The dicebear chart renders a valid HTTPRoute + HTTPRouteFilter when route config is supplied, and hard-fails when hostnames is omitted.

Checklist

• Update changelog in CHANGELOG.md.
• Make sure values.yaml and values.schema.json are valid.

[fiunchinho]

in which cases / scenarios would users set dicebear.route.enabled: false?

[marians]

In the rare case they don't have Envoy Gateway, they could use this to disable rendering the HTTPRoute resource. However, the chart doesn't offer any alternative (like Ingress), so it wouldn't really work.

[fiunchinho]

That's where I was heading. I wouldn't expose this setting at all, given that the alternative doesn't really work.