feat: release-secret size estimator + /helm-render-all check

[infojohn]

Why

Helm persists every release revision as a Kubernetes Secret whose payload
is base64(gzip(json.Marshal(release))), and Kubernetes hard-caps
Secret/ConfigMap objects at 1 MiB. This repo already hit that limit once
for podiumd — see the comment in charts/podiumd/.helmignore ("the docs
tree alone (~1.2M) pushed the release over that limit"). There was no
ongoing visibility into how close either chart is to that wall.

What

• charts/podiumd/scripts/helm-release-secret-size.py — estimates the
  release-Secret payload for any chart. It reconstructs the same
  Chart/Config/Manifest JSON shape Helm stores:
  • Subchart trees are excluded, matching real Helm behavior
    (chart.Chart.dependencies is an unexported Go field, so
    json.Marshal never serializes nested charts — only the manifest,
    which already includes every subchart's rendered output, and the
    top-level chart's own files/templates/values count).
  • File inclusion respects .helmignore by running helm package and
    reading the resulting .tgz, rather than walking the raw directory
    (this is what makes the podiumd number realistic — a naive
    directory walk overcounts by ~2.5x because it ignores the
    docs/ci/scripts exclusions .helmignore already relies on).
  • Cross-checked against an independent reference implementation using
    Helm's own Go SDK (helm.sh/helm/v4, same encodeRelease logic) —
    within 0.5% on both charts.
• --record appends/updates a per-version row in
  <chart>/docs/release-secret-size.md — a running history of this
  metric per release. Seeded here:
  • podiumd 4.8.3: 427,932 bytes (40.8% of 1 MiB)
  • monitoring-logging 1.0.15: 406,992 bytes (38.8% of 1 MiB)
• Exits non-zero with a warning once the estimate reaches 90% of the
  1 MiB limit.
• Wired into /helm-render-all (.claude/commands/helm-render-all.md)
  as a required step of the render-verify pass, with instructions to
  treat a 90%+ result as a release blocker, not a nitpick.

Test plan

• Ran against charts/podiumd with ci/lint-values.yaml and
  charts/monitoring-logging with defaults — both render and compute
  cleanly, results recorded above.
• Cross-validated against a from-scratch Go implementation using
  helm.sh/helm/v4's real chart loader + encodeRelease — agreed
  within 0.5%.
• Verified the .helmignore-driven discrepancy directly: a naive
  directory walk reported podiumd at 106% of the limit; reading the
  packaged .tgz (which correctly excludes docs/, ci/, scripts/)
  gives the accurate 40.8%.

Requires helm and yq (mikefarah/yq) on PATH.

🤖 Generated with Claude Code