fix(chart): TCP readiness/liveness probes on webhook port

Pod readiness now reflects webhook listener readiness, not just container
start. This fixes the e2e race where helm --wait returned Ready before the
webhook server bound to :9443 and the first kubectl apply failed with
connection refused.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: stubbi

charts/hermes-operator/templates/deployment.yaml

@@ -43,6 +43,19 @@ spec:
               protocol: TCP
             {{- end }}
           {{- if .Values.webhook.enabled }}
+          readinessProbe:
+            tcpSocket:
+              port: webhook
+            initialDelaySeconds: 2
+            periodSeconds: 2
+            failureThreshold: 30
+          livenessProbe:
+            tcpSocket:
+              port: webhook
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          {{- end }}
+          {{- if .Values.webhook.enabled }}
           volumeMounts:
             - name: webhook-cert
               mountPath: /tmp/k8s-webhook-server/serving-certs