Add opt-in Argo Rollouts to the Buzz Helm chart

[ravarora2]

Summary

Buzz's Helm chart currently creates only a Kubernetes Deployment. This adds an optional Argo Rollout so operators can introduce manual canary updates without replacing the existing pod configuration.

• Keep rollout.enabled: false by default. Existing Deployment and autoscaling behavior remain available.
• Keep the Deployment as the pod-template source. The Rollout reads it through workloadRef and creates its own pods.
• Require explicit rollout.deploymentReplicas and rollout.replicas. Enabling the flag alone fails instead of scaling down an existing Deployment.
• Set workloadRef.scaleDown: never; values control the handover counts. Reject counts below the fleet target or above one extra requested pod.
• Use fixed replicas, one surge pod, zero requested unavailable pods, and indefinite pauses around the configured canary weights. Reject HPA plus Rollout mode.
• Preserve the existing Service and PodDisruptionBudget selectors. Keep the Rollout checks in the existing validation template.

The initial Rollout revision skips canary steps. Operators must apply each handover step separately and verify health before draining another pod. Replica validation cannot prove healthy capacity.

This prepares chart version 0.1.9. It does not install the Argo controller, enable Rollouts in an environment, or add shadow analyses and automatic recovery decisions. Those remain separate changes.

Related issue

None found for chart opt-in support. Related observability work: #7546.

Testing

• Compared rendered output against base commit 213092074 for single-replica, two-replica, HPA, and custom-name configurations. Output was identical with chart metadata held at version 0.1.8.
• Replaced the candidate chart's defaults with the previous values.yaml to exercise missing rollout settings, as with reused release values. Fixed-replica and HPA output remained identical.
• Rendered the five handover states (Deployment/Rollout counts: 2/0, 2/1, 1/1, 1/2, 0/2) and checked their counts and selectors. Validated each Rollout against the official Argo v1.8.3 CRD schema with kubeconform.
• No cluster deployment performed. Full just ci was attempted but stopped at Rust linking because the local Xcode license is unaccepted.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 213092074c269bee90c87163672f9c2b8d714cfe...47af4f813039af0704ef2e44e573e004118dff24.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 47af4f813039af0704ef2e44e573e004118dff24 to authorize a new review.
Any previous review applies only to its recorded range.