[codex] add split persistence chart support

[seslly]

Summary

Adds generic Helm persistence support for split storage while preserving the current default single-PVC install path.

• Replaces the chart's scalar persistence.* values with persistence.claims[] and persistence.mounts[] blocks.
• Keeps the default layout as one data PVC mounted at /home/steam.
• Supports existingClaim per claim and arbitrary direct volumeMounts in both the game and UI containers.
• Adds top-level env[] wiring for game/UI containers as additive env only; duplicate names and chart-managed env collisions now fail template rendering.
• Documents a direct-mount split layout where the state PVC owns WindowsServer/R5, runtime mounts provide the large Steam-managed R5 directories, mod payload dirs are nested back onto state, and backups mount separately.
• Makes mod apply/backup restore preserve mounted ~mods directory roots while still clearing/replacing their contents.

This version intentionally does not add a runtime state sync loop or shadow-copy state directory. Split persistence is expressed through Kubernetes mountpoints. It also intentionally does not bump chart or image versions; release numbering can be handled by the release commit.

Dotfile/state handling

The current admin/runtime metadata files stay where they already are. In the split layout, WindowsServer/R5 is the state mount, so R5-root files such as .backup-config.json, .idle-patch-override, .maintenance-mode, .mods.json, .mods.staged.json, and .mods-staging/ live directly on the state PVC. Backup markers such as .auto and .mods-included live under the backup root. Runtime-only artifacts under SteamCMD/Proton and patched binaries stay on runtime storage.

Upgrade behavior

helm upgrade --reuse-values from the released 0.2.1 chart works for the old default scalar values and preserves the single-PVC layout. Customized old scalar values fail at render time with a generated migration snippet for the new claims[] / mounts[] shape.

Validation

• helm lint ./helm/windrose
• helm template windrose ./helm/windrose >/dev/null
• helm template windrose ./helm/windrose -f /tmp/windrose-split-direct-values.yaml >/tmp/windrose-split-direct-render.yaml
• helm template windrose ./helm/windrose --set persistence.size=20Gi >/dev/null
• helm template windrose ./helm/windrose --set persistence.size=21Gi fails with the expected migration snippet.
• helm template windrose ./helm/windrose --set 'env[0].name=SERVER_NAME' --set 'env[0].value=bad' fails because SERVER_NAME is chart-managed.
• helm template windrose ./helm/windrose --set 'env[0].name=EXTRA_ONE' --set 'env[0].value=a' --set 'env[1].name=EXTRA_ONE' --set 'env[1].value=b' fails because env[] duplicates itself.
• helm template windrose ./helm/windrose --set 'env[0].name=WINDROSE_BACKUP_ROOT' --set 'env[0].value=/home/steam/backups' >/dev/null
• python3 tests/test_restore.py
• python3 -m py_compile server.py tests/test_restore.py
• bash -n scripts/entrypoint.sh
• docker compose config --quiet
• git diff --check
• Fresh Helm default persistence smoke test: pod reached Ready with one PVC mounted at /home/steam.
• Fresh Helm direct split mount smoke test: pod reached Ready; mount table showed Longhorn backing WindowsServer/R5 plus ~mods / ~mods.disabled, and local-path backing Binaries, Config, Content, Plugins, and /home/steam/backups.
• Backup restore unit test covers mounted mod dirs: mounted ~mods roots are preserved while contents are cleared.
• Upgrade smoke test from published chart 0.2.1 to the local chart in this PR with --reuse-values: rollout completed and stayed on the single default PVC.
• Failure-path upgrade test from published chart 0.2.1 with customized persistence.size: 21Gi: upgrade failed before mutation with the migration snippet and left the release at windrose-0.2.1 revision 1.

Note: local shellcheck is not installed in this environment, so shellcheck is left to CI.