refactor(pgo)!: remove versionPolicy and settle the rest of item 8

[arloliu]

Roadmap item 8's remaining work. After this, all six bullets have an outcome: three shipped in #11,
one is done here, and two are withdrawn on evidence rather than left open.

pgo.versionPolicy is removed — this is breaking

Nothing branched on the value. ResolveVersion (internal/pgo/runtime.go) enforces version pinning
unconditionally from Target.Version, the optional pin, and never read VersionPolicy. So no sampling
or merge behavior changes. What goes is a one-valued enum, its validation, and the not_permitted code
whose sole producer it was — that code retires from the spec, from openapi.json, and from the
vocabulary the document check reads.

Two things a caller sees, both in the changelog under BREAKING:

1. decodeBody calls DisallowUnknownFields, so a client that round-trips the effective policy back as
   an override now gets 400 invalid_parameter with an unknown_field detail naming
   /target/versionPolicy, on PUT .../pgo and POST .../collections alike. Observed, not inferred.
2. SnapshotHash covers the marshalled Policy, so every hash moved. An Idempotency-Key minted before
   the upgrade replays as 409 idempotency_mismatch for as long as its receipt lives — a week by
   default. This was accepted rather than mitigated: the answer is arguably correct, since the key really
   does stand for a differently-represented policy, and a fresh key is the client's move.

An existing configuration file setting the key is refused by name through the node walk
refuseRemovedPprofKeys already established, rather than failing as a bare unknown key. The whole
pgo.defaults.target mapping goes, since versionPolicy was its only field.

Item 8 claimed no bullet needed a spec revision and that none changed client-visible behavior. Both were
wrong for this bullet, and the item now says so.

Two bullets withdrawn, with the evidence

The startup probes stay. They are the only thing that verifies NATS write permission, per bucket
and per verb, and watch delivery. The bucket-contract check reads stream information and writes nothing;
the runtime's watches prove subscribe, never publish; the sweeper's artifact listing warns and carries
on. "The first real operation" has no bound either: DefaultPolicy sets enabled false for every
Service and the scheduler passes only over Services carrying a stored override, so a gateway with
pgo.enabled: true and no override anywhere never writes to NATS at all. Today a denied probe is a
non-zero exit naming the bucket and the operation, so the new Pod crash-loops and the rollout stalls with
the old Pod still serving; without them the process would connect, pass the contract check, answer
/readyz 200, join the Service, and fail later. internal/natskv/ and internal/pgo/sweeper.go are
untouched.

Golden files for the chart are withdrawn. About 110 of the chart tests are refusals — they assert
helm template fails and grep stderr, so there is no output to record. Another group asserts agreement
between the render and something else in the repo, where a golden records one side and both sides moving
together would pass. Another asserts a relationship between two renders. And
deployment.yaml puts a sha256 over the whole rendered ConfigMap into the pod template, so any golden
holding it reddens on every values.yaml change with a diff that reads as one hex string becoming
another. The roadmap's "larger than the chart it tests" is 1.68x, not the multiple it implies, and the
denominator is mostly a validation program with 42 fail paths.

It is replaced by narrower work, done here: TestChartMountPartsAreValidated proved the same helper
twelve times, once per values key. Five rows document a trap nobody else does and stay; seven are the
same proof with a different key name and are now a table, after the model
TestChartBooleanTogglesAreValidated already set.

A decision record instead of a deletion

docs/decisions/chart-notes-assertions.md records why the assertions over the rendered NOTES.txt stay.
Deleting them was proposed because two real defects in those notes shipped uncaught. Both escapes are the
same kind — an instruction that reads correctly and does not work — and what the assertions hold is the
other kind: each authentication mode printing the instructions belonging to it and none of the others.
The record names what is not proven, and names the unwritten check that would have caught the first
escape, without claiming it is written.

Testing

mise run lint && mise run test && mise run check clean before every commit.

mise run test:e2e on the current lane: ok … 681.226s, all 27 scenarios. internal/pgo and
internal/client both changed, and both require it.

The collapse was proven not to lose coverage by sabotage: with the kindIs "string" check deleted from
profgate.mountPartString, twelve subtests go red before the change and twelve after — no looped row
stayed green. One failed differently and is the strongest evidence: --set nats.credsFile=false rendered
cleanly, showing the kind check is the only barrier for that key.