chore: reduce complexity

[dennisme]

Summary

Replaces the hand-maintained Chart.yaml version bump with a tag-triggered chart-releaser (cr) flow, so the chart repository publish path can no longer silently drift from the actual release.

• deploy/charts/grex/Chart.yaml version/appVersion pinned to 0.0.0 placeholder, never edited again. Every workflow that packages the chart passes an explicit --version/--app-version override derived from the git tag instead.
• New .github/workflows/helm-release.yaml (+ .github/cr.yaml config), triggered on push: tags: v*. Packages the chart, publishes it as its own GitHub Release (chart-grex-VERSION), and pushes the updated index.yaml to the gh-pages branch.
• .github/workflows/docs.yml no longer packages the chart locally. It fetches index.yaml from gh-pages and mirrors it into the unified Pages site. Added a workflow_run trigger on helm-release completion, since cr can publish its GitHub Release before the index push finishes, and the old release: published trigger alone could grab a stale index.
• justfile's release-tag recipe simplified: no more sed-bumping Chart.yaml or committing that bump. Just fetch tags, svu next, tag, push.
• .goreleaser.yaml / goreleaser.yaml workflow: removed the extra_files glob that was still attaching the chart .tgz to the app's own GitHub Release, now redundant with the chart's separate release.
• scripts/generate-releases-changelog.py: filters changelog entries to real app tags (^v\d+.\d+.\d+), so the chart's own release doesn't show up as a noise entry with a broken version string.
• Docs updated to match: docs/releases/index.md, docs/developer/releasing.md, docs/admin/helm.md, deploy/charts/grex/README.md.

Test plan

via release

[github-actions]

coverage

File	Coverage	Lines		Missing
All files	91%	91%	✅
cmd/grex/main.go	61%	61%	❌	56-58 140-169 179-181 188-190 194-198 213-231 241-247
cmd/river-migrate/main.go	90%	90%	✅	40-42
internal/api/filter.go	92%	92%	✅	105-107 181-183 189-190 202-204
internal/api/handler.go	93%	93%	✅	35 133 156-159 211-213
internal/config/config.go	95%	95%	✅	157-159 311-313 332-334
internal/fleet/registry.go	96%	96%	✅	355-356 382-384 430-432
internal/opamp/handler.go	90%	90%	✅	133-135 164-166 199-202 236-238 255-257
internal/persistence/postgres.go	79%	79%	✅	60-62 112-114 116-118 120-122 165-167 170-172 175-177 183-191 244-246 249-251 255-257 281-283 313-321 355-357 360-362
internal/persistence/purge.go	90%	90%	✅	88-90
internal/persistence/session_snapshot.go	70%	70%	✅	47-55
internal/persistence/write.go	86%	86%	✅	52-54
internal/server/mtls.go	95%	95%	✅	85-86
internal/server/server.go	92%	92%	✅	170-172 190-192 236-238 275-278
internal/testcert/testcert.go	92%	92%	✅	181-189
internal/ui/ui.go	95%	95%	✅	46 95-100 111-113 115-117 290-292 360-363 535-537 742-744

Minimum allowed coverage is 70%

Generated by 🐒 cobertura-action against 6b9e280