Give the chart image.digest, extra volumes and a Composio key

[guidovizoso]

Three things we had to work around deploying OpenBot on EKS, now as chart values. With none set, all five ci/ targets render byte-identical to main (checksum annotations aside).

image.digest

Set it to the digest from a release's container-images.json and the image becomes repository:tag@digest, which is the form docs/releasing.md recommends. The tag stays readable and the digest decides the pull. It refuses anything that isn't sha256: plus 64 hex characters. All four images in a sandbox render (server, computer, culler, migrations) carry it.

config.extraVolumes / config.extraVolumeMounts

These mount volumes on the server and the routines and computer-culler CronJobs: the pods that include commonEnv, and so load the configuration and the tenant package. The main use is a tenant package from a ConfigMap with tenantPackageDir pointed at it, no custom image needed. They're appended after the existing sandbox-template volume where there is one. The migrations and attachments-culler jobs read only the database, so they don't get them.

secrets.composioApiKey

Written to the chart's Secret as composio-api-key. Only the server receives COMPOSIO_API_KEY; the CronJobs don't, since only the API calls Composio. That follows the Learning token's "the server's alone" precedent. A new helper, openbot.secretKeySource, decides where the key comes from:

source	env
secrets.composioApiKey	required ref
externalSecrets.data names composio-api-key	required ref
secrets.existingSecret	optional: true ref
none	not emitted

#771 adds a license-specific version of the same logic. Whichever merges second can move the license onto openbot.secretKeySource.

Checks

• All five targets: lint, render and check-rendered-chart.ts pass.
• The digest renders on every image, and a bad digest is refused with a message.
• Volumes: parsed renders show the mount and volume on the server, routines and culler (sandbox target), and on the server and routines (self-hosted).
• Composio: each row above checked in parsed output, plus "absent from the CronJobs".
• Docs: a chart README row and two sections (digest, own tenant package), the Composio doc table, releasing.md, and the changelog.