docs: add chart updater App runbook

[xnoto]

Summary

• document GitHub App ownership, permissions, installation, and the four repository scopes
• document SOPS-backed key rotation, recipient expansion, smoke verification, and revocation
• persist the operator-guide link through terraform-docs generated README output

Validation

• git diff --check
• pre-commit run --all-files
• Terraform docs regeneration and fresh-reader documentation audit

Coordinated documentation

• docs: explain chart release automation charts#15
• docs: add workload rollout guidance kustomize-cluster#104

Cross-repository links target main and resolve after the companion PRs merge.

[github-actions]

OpenTofu CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan