P6: S3 blob store, Helm chart, air-gapped installer verify loop

- S3BlobStore (object_store, path-style) behind the same BlobStore trait,
  tested against a REAL MinIO container (round trip, overwrite, NotFound
  on get and delete, nested keys); [storage] backend=local|s3 config with
  validation + server-side selection (S3 creds via env overlay)
- Helm chart: server pod with the secret broker as a SIDECAR sharing a
  private emptyDir unix socket (no network hop carries credentials),
  frontend, optional local PVC vs S3, OIDC/oauth values, unbuffered-SSE
  ingress annotations, NetworkPolicies (frontend->server only), hardened
  securityContexts; ci/check-helm.sh lints AND asserts the rendered
  topology properties
- deploy/airgapped/install.sh: offline signature+checksum verification via
  the bundled teamclaw-bundler BEFORE any docker load; --verify-only mode;
  ci/test-install.sh rehearses clean/tampered/wrong-key paths with the
  real binary
- CI: helm gate + installer rehearsal wired in

149 Rust tests; helm lint + rendered assertions green; installer
verify-path rehearsal green.

Co-Authored-By: Claude Fable 5 <[email protected]>

deploy/helm/teamclaw/templates/networkpolicy.yaml

@@ -0,0 +1,44 @@
+# The broker has no Service and shares the server pod, so its socket is
+# already unreachable over the network. These policies enforce the rest of
+# the §15 topology: the database secret-holders are the only egress-capable
+# pods, and the frontend can reach only the server.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: teamclaw-frontend-egress
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 6 }}
+  policyTypes: [Egress]
+  egress:
+    # DNS, then only the server.
+    - to: []
+      ports:
+        - { protocol: UDP, port: 53 }
+        - { protocol: TCP, port: 53 }
+    - to:
+        - podSelector:
+            matchLabels: {{- include "teamclaw.serverSelector" . | nindent 14 }}
+      ports:
+        - { protocol: TCP, port: 8080 }
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: teamclaw-server-ingress
+  labels: {{- include "teamclaw.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels: {{- include "teamclaw.serverSelector" . | nindent 6 }}
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 14 }}
+        # Ingress controller namespaces vary; admit via namespace selector.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-nginx
+      ports:
+        - { protocol: TCP, port: 8080 }