Add opt-in Helm support for the command backend

[tnederlof]

Summary

• Adds an opt-in backend.type=command path to the Helm chart so the worker can run in Kubernetes and dispatch via a mounted script instead of creating task Jobs.
• Keeps the default chart path on the existing Kubernetes task Job architecture (backend.type=kubernetes).
• Documents mounting dispatch/cancel scripts via ConfigMap/Secret volumes, including that script runtimes (e.g. Python) must be added to a custom image.
• Note: our example script uses Python which isn't installed in the default image so need to nudge people if they want to use this method, they need to extend the image to support whatever scripts they load on.

Test plan

• helm lint with default values and command-backend values
• Default rendered manifests match pre-change chart output byte-for-byte for the same values
• Command mode renders backend.command, mounts, and omits task Job/Pod Role/RoleBinding
• Live GKE default backend: isolated release created task Job and completed a real Oz run
• Live GKE command backend: ConfigMap-mounted script received dispatch payload; no task Jobs/RBAC
• README example values render successfully

Co-Authored-By: Warp Agent agent@warp.dev

[warp-agent-staging]

Overview

This adds an opt-in command backend to the Helm chart while preserving the existing Kubernetes default. The rendered template behavior is correct in the exercised cases, but the new path needs durable coverage and the documented install flow needs revision before merge.

Concerns

• The Helm job still lints and renders only default values, so none of the new backend.type=command branches are protected. Add committed Helm tests or CI assertions for command config/args/volumes, Role/RoleBinding presence by mode, invalid backend rejection, and the required dispatch command.
• The chart overview still says the chart always deploys Role/RoleBinding and always creates one Kubernetes Job per task. Qualify those statements by backend: task RBAC and Jobs exist only for kubernetes; command invokes the mounted dispatcher.

Verdict

Checks: build pass, tests pass, CI green, visual proof n/a

Found: 0 critical, 4 important, 1 suggestion, 0 nits

All review findings were addressed in 6b1658f, the three inline threads are resolved, and all seven required checks pass.

[warp-agent-staging]

Overview

The revision addresses all prior findings: command-mode Helm coverage is committed, the setup flow is namespace-correct, the Python image requirement is explicit, Secret wiring is safe, and the backend-specific chart behavior is documented. Approve.

Verdict

Checks: build pass, tests pass, CI green, visual proof n/a

Found: 0 critical, 0 important, 0 suggestions, 0 nits