feat: revamp public helm charts

[sidpalas]

🧠 Ai UsageDetails (if applicable):

IMPORTANT: Please disclose any usage of ai tooling while making this change. If you did not use any AI write "NA" below

Example: Used ChatGPT to help with doc phrasing.
Example: Code generated by Copilot; reviewed and verified manually.

Initial implementation with opencode + codex, manual + opencode refactoring and testing

---

• Added taco-sidecar Helm chart and integrated it into the opentaco umbrella chart.
• Added opentaco-platform-reference helm chart to provision platform resources (cloudnative-pg, minio, traefik)
• Added cronjobs to taco-drift for execution and notification triggers
• Added cloudsql / workload identity support to taco-orchestrator
• Added first-class orchestrator URL split for public vs internal addressing:
  • PUBLIC_BASE_URL (public URL generation, e.g. GitHub app flows)
  • INTERNAL_BASE_URL (internal self-calls)
  • with legacy HOSTNAME fallback for compatibility.
• Added first-class helm config for project refresh/background execution behavior in taco-orchestrator
• Use -public postfix for chart versions
• Bump all chart versions + umbrella references