feat(chart): optional dedicated ServiceAccount and Ingress for fleet-manager

[Bugs5382]

What and why

Refs #199

cryptos-release (retired) carried two chart templates chart/fleet-manager
doesn't have: a dedicated ServiceAccount and an Ingress. I decided both are
worth having, both off by default:

• serviceAccount.create: a dedicated ServiceAccount with
  automountServiceAccountToken: false, so the pod doesn't need the
  namespace's default ServiceAccount's token mounted. The pod's
  serviceAccountName is now always explicit in the rendered manifest (the
  namespace's default when serviceAccount.create is false -- the same
  behavior as before this change, just spelled out).
• ingress.enabled: an Ingress with className, annotations, hosts and
  tls, so exposing the manager no longer needs a separately-managed
  Ingress, LoadBalancer Service, or port-forward.

Both templates are adapted from the issue's pasted source: manager.* helper
names swapped for fleet-manager.*, license header dropped (this repo's own
header convention applies at the Go level, not Helm templates).

Merge order note: this PR and #201 (fix#194)
both add .github/workflows/job-chart-lint.yaml, independently, off the same
base commit. Whichever merges first wins the file as committed; the other
will need a small rebase to fold its scenarios into the surviving file rather
than overwrite it. Neither PR depends on the other's chart.fleet-manager
behavior otherwise.

Verification

• Lint clean
• Tests pass (no Go changes in this PR; chart-only)
• Build succeeds
• Documentation updated (values.yaml comments)

How this was verified

• helm lint for the defaults, serviceAccount.create: true, and
  ingress.enabled: true (with a representative host/class/path): all clean.
• helm template: confirmed neither the ServiceAccount nor the Ingress
  renders by default, and that the pod's serviceAccountName is explicitly
  default in that case; confirmed the ServiceAccount renders with
  automountServiceAccountToken: false and the pod picks it up when enabled;
  confirmed the Ingress renders with the configured ingressClassName,
  host and path when enabled. Added as
  .github/workflows/job-chart-lint.yaml so these run on every PR that
  touches the chart (see the merge-order note above).
• A real kind install with both features enabled together: the
  ServiceAccount, Ingress and Deployment all render and create successfully;
  kubectl get sa fleet-manager -o jsonpath='{.automountServiceAccountToken}'
  returns false, kubectl get deploy fleet-manager -o jsonpath='{.spec.template.spec.serviceAccountName}' returns
  fleet-manager, and the Ingress shows the configured class and host.

---

Before merging: add a closing comment summarizing what was actually done in this PR
(not just the checked boxes).

[Bugs5382]

Approved. The optional Ingress and dedicated ServiceAccount, off by default. Refs #199