feat(common): IRSA preflight init-container hard gate

[OleksandrUA]

What

Adds an opt-in serviceAccount.irsaCheck.initContainer to the common chart. When enabled it injects an irsa-preflight init container into the Deployment/StatefulSet that assumes the IRSA role and runs a read-only AWS probe before the main container starts:

• aws sts get-caller-identity - proves the assume-role works
• aws sqs get-queue-url --queue-name <queue> - proves SQS reachability and the role's queue grants

If the probe fails the pod never becomes Ready, so helm upgrade --atomic --wait rolls the whole release back instead of shipping a credential-less or broken-IRSA workload.

Why

The existing irsaCheck helm-test is a post-deploy sanity check - it runs after the release already succeeded, so a broken IRSA config can still roll out. This adds the missing hard gate at pod startup. The two are complementary; the helm-test is kept.

The values key is AWS-service-agnostic so other read-only probes can be added later without renaming it. get-queue-url is the only truly read-only call within the keeperhub queue policy (GetQueueAttributes is not granted; ReceiveMessage would side-effect a message).

Changes

• common.irsaPreflightInitContainer helper, rendered by deployment.yaml and statefulset.yaml (single initContainers: block, preflight first, coexists with user-supplied init containers).
• New serviceAccount.irsaCheck.initContainer values block (enabled/region/queueName/resources), default disabled.
• helm-unittest coverage (disabled-renders-nothing, enabled-renders-correctly, default-resources, coexistence-single-block).
• Version bumps: common 0.4.0 -> 0.5.0, keeperhub-stack 0.2.0 -> 0.3.0 (common dependency re-pinned and repackaged).

Verification

• helm unittest charts/common: 10/10 pass.
• Umbrella rendered with the real staging and prod deploy values: all 5 components get exactly one irsa-preflight init container with the correct region/queue per env; the app component keeps its db-migration init container after the preflight.
• Not exercised in CI dry-run (kind has no IRSA, so the probe would fail there by design); the live STS/SQS path is validated staging-first on EKS.

[github-actions]

🎉 Helm Chart Tests Passed!

All modified charts have been successfully validated:

Chart	Version Check	Template Validation	Dry-run Installation	Overall Status
common	✅ Incremented	✅ Passed	✅ Passed	✅ Passed
keeperhub-stack	✅ Incremented	✅ Passed	✅ Passed	✅ Passed

Summary:

• ✅ Charts tested: common, keeperhub-stack
• ✅ All template validations passed
• ✅ All dry-run installations passed

📋 Detailed Information:

• 🔗 View workflow run
• 📁 Download detailed test logs
• 💡 Click the download link above to get detailed logs for all helm operations.

The PR is ready for review! 🚀

Note: Charts will be automatically released when this PR is merged to main.

[OleksandrUA]

Closing - the IRSA preflight does not need a dedicated chart feature. The existing common chart already supports deployment.initContainers, so the gate is implemented as a plain init-container entry in the keeperhub deploy values (KeeperHub/keeperhub#1615) with no chart change, version bump, or republish. Keeps it modular and avoids touching the shared chart.