feat(logs): opt-in percent-encoding for log URL templates and non-fatal validation

[roberteggl]

Motivation

• Improve the operational link experience by making log URL templates safe to use in both path and query positions while keeping the GitHub Deployment payload minimal.
• Preserve existing behavior and per-workload github-deployment-bridge.io/log-url annotation precedence so current installs are not broken.

Description

• Add LOG_URL_TEMPLATE_ESCAPE / config.logURLTemplateEscape to opt-in percent-encoding of substituted values and implement ExpandLogURLTemplateEscaped to perform encoded replacements (uses url.QueryEscape with + → %20).
• Wire the new option into the reporter so templates (global or annotation) are expanded with optional escaping and expanded URLs are validated as absolute HTTPS; invalid expansions are omitted and a clear workload-scoped warning is logged instead of failing reconciliation.
• Keep backwards compatibility: literal substitution remains the default behavior and per-workload log-url annotation still wins over the global template.
• Update Helm values/schema, Deployment env vars, README and docs with copy-paste presets for Grafana Loki Explore, Grafana dashboard, and a generic Flux/Kubernetes dashboard, plus Kustomization/HelmRelease/monorepo examples and runbook troubleshooting notes.
• Add table-driven unit tests covering template expansion, escaping behaviour, documented presets, annotation overrides, and a reporter test asserting invalid expanded URLs are skipped and logged.

Testing

• Ran unit tests: go test ./internal/config ./internal/deployment ./pkg/metadata and all tests passed.
• Built docs/site: npm run build completed successfully.
• git diff --check returned no issues; helm lint and reuse lint were not executed in this environment (tools not installed).

---

Codex Task