feat: add openab-telegram chart

[chaodu-agent]

Summary

Adds charts/openab-telegram/ — a standalone Helm chart that deploys OAB + Gateway + Cloudflare Tunnel in a single pod, following the reference architecture.

Install

helm install my-bot ./charts/openab-telegram \
  --set telegramBotToken="123:ABC" \
  --set cloudflareTunnelToken="eyJ..." \
  --namespace openab --create-namespace

Only 2 required flags. Everything else has sane defaults.

Credential Management

Three options from simplest to most secure:

#	Method	Security	Notes
1	--set telegramBotToken=X	⚠️ Stored in Helm release Secret, visible via helm get values	Good for dev/testing
2	kubectl create secret --from-literal + --set existingSecret=name	✅ Out of Helm values, brief shell exposure	Good for production
3	kubectl create secret --from-env-file=<(aws sm ...) + --set existingSecret=name	✅✅ Never touches disk or shell variables	Best for security

Option 3 example (AWS Secrets Manager → K8s Secret, no disk/shell exposure):

kubectl create secret generic my-bot-creds -n openab \
  --from-env-file=<(aws secretsmanager get-secret-value \
    --secret-id oab --query SecretString --output text | \
    jq -r '{"telegram-bot-token": .telegramBotToken, "cloudflare-tunnel-token": .cloudflareTunnelToken} | to_entries[] | "\(.key)=\(.value)"')

helm install my-bot ./charts/openab-telegram \
  --set existingSecret=my-bot-creds \
  --namespace openab --create-namespace

Release Channel

Users can switch between stable and beta for the core image:

channel	Core image tag	Gateway image tag
stable (default)	0.8.3	v0.5.0 (pinned)
beta	0.8.3-beta.12	v0.5.0 (pinned)

Gateway is pinned independently since it has its own release cadence (gateway-v* tags).

What it does

• Colocates 3 containers in one pod: openab (agent), gateway (Telegram adapter), cloudflared (tunnel)
• All inter-container communication over localhost — no Services needed
• existingSecret support — reference a pre-created K8s Secret, chart skips Secret creation
• Security contexts (non-root, read-only rootfs, drop all caps)
• Post-install NOTES.txt with webhook setup and auth instructions

Design Decision

This is a standalone chart (not a subchart wrapper) because:

1. The core chart cannot template dynamic Secret names into extraContainers values
2. Full control over the pod spec without fighting subchart value injection
3. Simpler to understand and maintain — all templates are self-contained
4. The config.toml surface is much smaller (gateway-only, no Discord/Slack)

Future platform charts (openab-line, openab-feishu, etc.) can follow the same pattern.

Tested

• helm lint ✅
• helm template renders correctly ✅
• Required value validation (fails fast with clear error) ✅
• existingSecret mode (skips Secret, references external) ✅
• Platform restriction overrides (allowAllUsers=false) ✅
• Channel switching (stable / beta) resolves correct tags ✅

Closes #872

[github-actions]

⚠️ This PR is missing a Discord Discussion URL in the body.

All PRs must reference a prior Discord discussion to ensure community alignment before implementation.

Please edit the PR description to include a link like:

Discord Discussion URL: https://discord.com/channels/...

This PR will be automatically closed in 3 days if the link is not added.