feat: expose supervisor middleware registrations through Helm values #2286

Problem Statement

PR #2027 adds static external supervisor middleware registration through [[openshell.supervisor.middleware]] in gateway.toml. The supported Helm installation path does not currently expose or render these registrations, so Kubernetes operators cannot configure the feature through chart values.

This is a packaging and configuration-surface gap rather than a middleware runtime security issue. Runtime registration through gateway TOML remains available.

Related work: #1733, #2011, and PR #2027.

Proposed Design

Add a typed list under the Helm supervisor configuration for external middleware services. Each entry should support:

• name
• grpcEndpoint
• maxBodyBytes
• Optional timeout

Render each entry as a separate [[openshell.supervisor.middleware]] table in the gateway ConfigMap. Preserve list order, quote string values safely, and omit optional timeout values when unset.

Update chart documentation and gateway configuration guidance for Kubernetes deployments.

Add Helm unit tests covering:

• No registrations by default.
• One registration without a timeout.
• Multiple registrations.
• An optional timeout.
• Correct TOML quoting and field names.

Alternatives Considered

An unrestricted raw TOML extension would expose the feature with less template work, but it would bypass the chart typed configuration surface and make validation, documentation, and upgrades harder. A typed list matches the existing Helm configuration model and limits the rendered scope to supported fields.

Keeping Helm rendering in PR #2027 was also considered. It is deferred because the runtime, policy, and security behavior are independent of Kubernetes packaging and can be reviewed separately.

Agent Investigation

The gateway chart currently renders gateway.toml from deploy/helm/openshell/templates/gateway-config.yaml. Neither that template nor deploy/helm/openshell/values.yaml exposes supervisor middleware registrations. Existing gateway ConfigMap tests in deploy/helm/openshell/tests/gateway_config_test.yaml provide the appropriate regression surface.

Possible duplicates were searched. #2011 is the broad external-middleware phase issue, while #1886 covers provider configuration and is not a suitable tracker for this chart-specific work.