Release the chart as 0.4.0, and let it express the engine token

[DavidNic11]

What & why

The Temporal engine landed across #196–#199 without the umbrella chart's
version moving off 0.3.0. Charts publish under that version and OCI tags
are mutable, so each of those merges overwrote 0.3.0 in place — anyone
"pinned" to it silently received a different chart. #199's publish then failed
on a transient GHCR error, which is the only reason its enable-by-default
values are not already live for 0.3.0 consumers.

This bumps the chart to 0.4.0, and closes the half of #199's own gap that it
left open.

AGENT_ENGINE got a chart path; the token did not

#199 fixed exactly the problem it described — AGENT_ENGINE could not be
expressed in values — but the switch needs two things, not one.

The engine gateway resolves the caller's roles from a bearer token
(resolveCaller → rbac.StaticResolver) and re-resolves every skill/agent
target under them. A deployment that sets AGENT_ENGINE and nothing else
reaches a gateway that fails closed to zero capabilities and denies every
turn. There was no values path to AGENT_TEMPORAL_ENGINE_TOKEN at all.

secrets.temporalEngineTokenKey follows the convention its neighbours already
use — a key name into secrets.existingSecret, rendered only when
config.agentEngine is set.

It is optional: true deliberately. The alternative to a token is the
gateway's own defaultSubject/defaultRoles, not a broken pod — but one of
the two must be configured or a turn resolves nothing, and the values
comments now say that on both sides.

Also here

• temporal-engine added to Chart.lock, which never recorded it.
• Two Chart.yaml descriptions still said the engine was "off by default",
  which Enable the Temporal engine by default (DRAFT — blocked on the e2e run) #199 made untrue.

Verification

• helm template with config.agentEngine unset is byte-identical to
  before this change (diffed rendered manifests) — same property Enable the Temporal engine by default (DRAFT — blocked on the e2e run) #199 claimed
  for itself.
• With agentEngine=temporal, AGENT_ENGINE, AGENT_TEMPORAL_ENGINE_URL and
  AGENT_TEMPORAL_ENGINE_TOKEN all render, the last as a secretKeyRef into
  secrets.existingSecret.
• Full umbrella render against a real downstream values file: all three engine
  Deployments, both gateway Services, and the derived CALLBACK_BASE_URL
  resolves to a Service that exists.

Risk

Publishing 0.4.0 does not disturb anyone tracking 0.3.0. Note that the
enable-by-default values from #199 reach an installation the moment it moves to
0.4.0, so consumers need their temporal-engine image repositories and
Temporal address configured before they bump — the chart defaults are
temporal-engine-worker:latest, which resolves to Docker Hub.

🤖 Generated with Claude Code

[imaustink]

🚢