Fix Garage integration promotion blockers

Summary

• Follow-up to Garage package MR !30 (closed) that resolves the remaining promotion blockers without modifying the assignee's source branch directly.
• Preserves standalone StatefulSet and PVC identities by removing the package-wide fullnameOverride; the companion umbrella MR owns the stable integrated release name.
• Expands the content-addressed init Job identity to all configurable behavior inputs.
• Adds mandatory authenticated S3 PUT/GET/SHA-256/DELETE coverage and limits test create RBAC to pods/exec only.
• Restores the current main Renovate configuration and aligns package documentation with the corrected behavior.

Validation

• helm lint chart: passed.
• Default and Big Bang feature-enabled helm template renders: passed.
• Package Helm unit tests: 2 suites, 16 tests passed.
• Python bytecode compilation and shell syntax validation: passed.
• Generated README reproduced byte-for-byte with jnorwood/helm-docs:v1.14.2 and the Gluon alias templates.
• Strict Renovate validation passed with Repo1 CI-pinned renovate:43.268.4.
• Big Bang/Flux k3d-dev clean install passed on package c0cc9dc: HelmRelease Ready, three Garage pods, six PVCs, a successful init Job, healthy HTTPS Prometheus targets, and all Helm test hooks successful.
• Seeded 0.9.3-bb.0 upgrade passed on runtime package commit 7733c1a (the remaining package delta is documentation only): StatefulSet UID and all six PVC/PV identities were preserved, and the authenticated S3 object retained SHA-256 b736641ff1daa50f1ae4042f143931d8f46a9e910c3f49ea730b4c85ee9a79e0.
• Authenticated Helm test S3 PUT/GET/SHA-256/DELETE passed; init same-secret 409, mismatched-secret rejection, all-input Job hash rotation, and least-privilege RBAC passed.
• Companion umbrella exact head 8b5184dc passed custom-environment token matching plus automatic StatefulSet and DaemonSet injection transitions over healthy HTTP/HTTPS monitoring paths; the cluster returned to the default StatefulSet with all original PVC identities preserved.
• Fresh exact-head package pipeline 5473947 and child pipeline 5473949 passed configuration validation, chart-update check, and combined clean-install/Helm/integration tests after parsing this MR's ## Umbrella Branch block and cloning the latest 23-integration-blockers-mv umbrella branch.
• Package CI uses skip-job-upgrade because only the shared generator's baseline half is hard-coded to render this MR's integrated-path values against umbrella master, where addons.garage is not yet schema-valid. The clean/candidate path correctly honors the branch block. The seeded k3d-dev upgrade above covers the skipped lane directly; the companion umbrella exact-head upgrade lane passed and supplies the integrated upgrade coverage.

Supporting Evidence

Blocker fixed: Garage reconciles at the corrected package version

Blocker fixed: The three-node Garage workload is healthy

Blocker fixed: All Garage Helm test hooks pass

Blocker fixed: Authenticated S3 PUT, GET, checksum, and DELETE pass

Blocker fixed: Prometheus reaches Garage through Istio mTLS

Blocker fixed: Test RBAC is limited to the required pod exec operation

Blocker fixed: Exact package source and persistent volume identities are preserved

Umbrella Branch

staging-garage-epic

Linked issues

Relates to #23 (closed)

Follow-up to !30 (closed)

Companion umbrella MR: big-bang/bigbang!8029 (merged)

Upgrade Notices

This follow-up removes the unmerged package-level upstream.fullnameOverride. Standalone releases therefore retain their existing release-derived StatefulSet, Service, Secret, and PVC names. The companion umbrella change sets releaseName: garage before Garage's initial integrated release.