feat(deploy): add Helm teardown cleanup hooks

[msaad00]

Summary

• add packaged Helm pre/post-delete cleanup hooks for product-owned in-cluster leftovers
• label ExternalSecret-generated target secrets so the cleanup hook can remove them explicitly
• document the updated destroy flow alongside the existing Terraform baseline and teardown helper

Testing

• uv run pytest tests/test_deploy_k8s_cleanup.py tests/test_deploy_manifests.py -q
• uv run ruff check src/agent_bom/deploy_k8s_cleanup.py tests/test_deploy_k8s_cleanup.py tests/test_deploy_manifests.py
• uv run mypy src/agent_bom/deploy_k8s_cleanup.py
• uv run mkdocs build --strict
• PATH="/tmp/helm-bin/darwin-arm64:$PATH" python3 scripts/validate_helm_profiles.py --profile focused-pilot
• PATH="/tmp/helm-bin/darwin-arm64:$PATH" python3 scripts/validate_helm_profiles.py --profile production

Closes #1635