feat(chart): add supervisor.extraInitContainers hook (PLT-1553)

[gantipr-gs]

Summary

Adds a supervisor.extraInitContainers hook to the supervisor Deployment so init containers can be prepended via values. Accepts a list, or a string that is tpl-rendered in chart scope — the same contract as webapp.extraContainers.

Why: the supervisor makes a single connect call to the webapp at boot (SupervisorSession.start() → httpClient.connect()) and throws when it fails, so the process exits 1 and Kubernetes restarts it with backoff. apps/supervisor/src/env.ts exposes no connect-retry or timeout knob. On FedStart the single-replica webapp runs Prisma + ClickHouse migrations at boot, so a node drain that reschedules both pods leaves the supervisor crash-looping for ~8 minutes (2–5 restarts, TriggerRestartStorm pages). The GovSignals umbrella uses this hook to add a wait-for-webapp curl loop against /healthcheck, which keeps the pod in Init:0/1 (no restart counter) until the webapp answers — see GovSignals/govsignals#4844.

Default [] renders byte-identical to before.

Changes

• templates/supervisor.yaml: tpl-render supervisor.extraInitContainers into a variable, then emit initContainers: only when the built-in init-shared container (bootstrap off) or the rendered extras are non-empty.
• values.yaml: document + default supervisor.extraInitContainers: [].
• README.md: "Supervisor init containers" section with the wait-for-webapp example.
• Chart.yaml: bump 4.5.7-plt663.9 → 4.5.7-plt663.10.

Test plan

• helm dependency build + extract + helm lint --values ci/lint-values.yaml pass.
• Default values: rendered supervisor Deployment is byte-identical to gs-v4.4.4 (diffed helm template output).
• webapp.bootstrap.enabled=false alone → only init-shared.
• String form using {{ include "trigger-v4.fullname" . }} / .Values.webapp.service.port → renders under initContainers.
• List form with an embedded template string → renders.
• String that renders to nothing → no initContainers key.
• String form + bootstrap off → init-shared first, then the extra.
• Prerelease subchart published by CI; consumed by the umbrella repin in GovSignals/govsignals#4844.

PLT-1553

🤖 Generated with Claude Code

[github-actions]

🧭 Helm Chart Prerelease Published

Version: 4.5.7-plt663.10-pr27.fbb70e0

Install:

helm upgrade --install trigger \
  oci://ghcr.io/govsignals/charts/vendored-upstream-trigger \
  --version "4.5.7-plt663.10-pr27.fbb70e0"

⚠️ This is a prerelease for testing. Do not use in production.