feat(executor): executor.cache block for provider + module caching (chart 4.8.0)

[TigranKhudav]

Summary

Adds an executor.cache block that sets up job-to-job caching for the executor in one place:

executor:
  cache:
    enabled: true
    path: /home/cnb/.terraform.d   # mount point of the cache volume
    sizeLimit: 2Gi                 # emptyDir size; or
    existingClaim: ""              #   an existing PVC (RWX when replicaCount > 1)
    providers: true                # TF_PLUGIN_CACHE_DIR=<path>/plugin-cache
    ignoreLockFile: false          # TF_PLUGIN_CACHE_MAY_BREAK_DEPENDENCY_LOCK_FILE=1
    modules: true                  # TerraformDataDirCacheRoot=<path>/data  (executor support: terrakube-io/terrakube#3478)

Today the Provider Cache docs tell users to add a volume, a mount and the env var by hand; it is easy to end up with the volume mounted and the variable missing (which is exactly what we found in our own deployment — the cache dir stayed empty). modules: true wires the new executor setting that also keeps the modules between jobs of the same workspace; older executor images simply ignore that variable.

Disabled by default: rendering is byte-for-byte unchanged for existing values files (helm template diff is empty). values.schema.json, the README values table and the chart version (4.8.0) are updated.

Test plan

• helm lint
• helm template with the default values → no cache env/volume rendered
• --set executor.cache.enabled=true --set executor.cache.ignoreLockFile=true → emptyDir volume with sizeLimit, mount at /home/cnb/.terraform.d, the three env vars
• --set executor.cache.existingClaim=tf-cache --set executor.cache.path=/cache/ --set executor.cache.providers=false → PVC volume, trailing slash trimmed, only TerraformDataDirCacheRoot set

🤖 Generated with Claude Code

[TigranKhudav]

Follow-up commit: when executor.cache.enabled the chart now also renders an init container (executor image, same user) that creates <path>/plugin-cache and <path>/data. Terraform/OpenTofu do not create TF_PLUGIN_CACHE_DIR themselves and a fresh volume is empty, so without it every init reported The specified plugin cache dir ... cannot be opened — found while dogfooding the values on our cluster. User-supplied executor.initContainers are still rendered after it; nothing renders when the cache is disabled.