Helm chart for single-replica daemon deployment

[mostafa]

Summary

Add a Helm chart that deploys a single-replica rsigma daemon on Kubernetes with ConfigMap-mounted rules, ServiceMonitor scraping, probes on the existing health endpoint, optional PVC for SQLite state, and NATS credentials via Secrets.

Motivation

The Docker image already ships, but operators still hand-author manifests. A chart is the production deployment story for single-replica streaming detection and the baseline for a later multi-replica chart.

Proposed approach

• Chart resources: Deployment, ConfigMap for rules, Service, ServiceMonitor, PDB, optional PVC for state.
• Wire readiness/liveness to the daemon HTTP health endpoint.
• NATS URL and TLS material via Secrets; document single-replica plus optional NATS assumptions.
• Values for image, resources, rule mounts, and sink/source config overlays.

Out of scope

• Multi-replica / StatefulSet clustering (separate follow-on).
• A full Kubernetes operator with CRDs (separate project).

Tasks

• Scaffold chart under an agreed path (for example deploy/helm/rsigma)
• Deployment, ConfigMap, Service, probes, optional PVC
• ServiceMonitor and PDB
• Secret-backed NATS settings
• Docs: single-replica install and values reference

References

• Docker image and hardening notes in the root README
• Daemon health and metrics endpoints
• Existing docker run documentation