test: guard 3rd-party image-override pull-secret contract in integration deploys

[eamonnmoloney]

Which problem does the PR fix?

This repo's reusable integration-test workflow (test-integration-template.yaml / test-integration-runner.yaml) is invoked by 3rd-party callers (camunda/camunda, camunda/connectors, camunda/identity, the web-modeler repo, …) that override component images to registry.camunda.cloud builds. A change here can silently break those callers — most recently connectors hit ImagePullBackOff because its overridden image had no matching pull secret.

There was no guard preventing this class of breakage from shipping before a downstream repo consumed the chart.

What's in this PR?

A general deploy-behaviour contract guard (not specific to the connectors bug):

The contract. Helm resolves a component's pull secrets as "component-level image.pullSecrets if set, else global.image.pullSecrets" — component-level replaces global, it is not merged (templates/common/_helpers.tpl: camundaPlatform.imagePullSecrets / subChartImagePullSecrets). So every component a caller can repoint to the private registry (the top-level keys of base-image-tags.yaml) must resolve a pull-secret set containing registry-camunda-cloud.

Fix. Add registry-camunda-cloud to global.image.pullSecrets in each active version's chart-full-setup/values/base.yaml, so every current and future caller-overridable component is covered by default.

Guard. TestThirdPartyImageOverrideHasPullSecret (in scripts/deploy-camunda/matrix/, run by make go.test) walks every active chart version, reads the caller-overridable component set from base-image-tags.yaml, replays the Helm pull-secret resolution against the merged chart-full-setup values, and fails if any component would not get registry-camunda-cloud. It is driven by chart-versions.yaml + base-image-tags.yaml, so new versions and newly-overridable components are covered automatically. Accompanying unit tests pin the resolution/merge logic.

Docs. The contract is documented in .github/AGENTS.md (Layered Values System section).

Verified locally: go test ./matrix/ (full matrix suite incl. the new guard) passes; gofmt clean; Apache header present. The guard was confirmed to fail when the secret is removed (resolution unit test covers the missing-secret case).

This generalizes the connectors-specific fix in #6449 — with global.image.pullSecrets covering all components, no per-component entry is required, though existing explicit ones (webModeler, connectors) remain valid.

Checklist

Before opening the PR:

• In the repo's root dir, run make go.update-golden-only.
• There is no other open pull request for the same update/change.
• Tests for charts are added (if needed).
• In-repo documentation are updated (if needed).

After opening the PR:

• Did you sign our CLA (Contributor License Agreement)? It will show once you open the PR.
• Did all checks/tests pass in the PR?