test(charts): add helm-unittest suite for requests-proxy-service template

[saadqbal]

What

Adds a helm-unittest suite for the previously-untested templates/requests-proxy-service.yaml Service template.

The requests-proxy-service fronts the egress requests-proxy (the component issuing stateless signed pod-proxy tokens), so its ClusterIP-only posture is a security-relevant property. This suite locks that in alongside the Service's name/selector/port contract.

Coverage delta

• +1 template suite (requests-proxy-service); 8 tests / 16 assertions
• Chart suites: 17 → 18
• requests-proxy-service was the highest-priority remaining untested template (Service tier, security-relevant) — requests-proxy-deployment was already covered in client#194.

Assertions

• single Service document, kind: Service
• stable name requests-proxy-service
• spec.type: ClusterIP and explicitly not NodePort / LoadBalancer (no external exposure of the egress proxy)
• selector app=requests-proxy
• single http port 8888/8888 TCP
• app=requests-proxy + standard chart labels (managed-by, helm.sh/chart)
• renders into the release namespace

Verified green locally: helm unittest -f 'tests/requests_proxy_service_test.yaml' ./client → 8 passed.

Tests-only; no source/template/values changes; security invariants unchanged.

Tracking epic: #193

---

Note

Low Risk
Test-only change with no runtime or chart template modifications.

Overview
Adds a helm-unittest suite for templates/requests-proxy-service.yaml, which had no chart tests before.

The eight tests pin the egress requests-proxy Service contract: one Service named requests-proxy-service, ClusterIP only (explicitly not NodePort/LoadBalancer), selector app=requests-proxy, a single TCP http port on 8888, standard chart labels, and release-namespace placement.

Tests-only; no Helm template or values changes.

^{Reviewed by Cursor Bugbot for commit d433cb2. Bugbot is set up for automated code reviews on this repo. Configure here.}