Add subchart-safe helpers so consumers can reference substrate resources by name

[jjamroga]

Summary

Consumers of this chart as a subchart (e.g. kagent-dev/kagent) need to reference release-name-prefixed resource names — the ate-api-server ServiceAccount for tenant-namespace RBAC bindings, and the ateapi / atenet-router Service DNS names for controller env vars. Previously each consumer had to know the fullname prefixing scheme and hard-code its own defaults; the recent kagent 0.0.8 substrate bump had to set controller.substrate.ateApiServer.serviceAccount by hand because kagent's default ate-api-server is the standalone-render name, not the <release>-ate-api-server this chart actually creates.

Two changes to charts/substrate/templates/_helpers.tpl:

1. Make substrate.fullname context-safe. It previously compared $ctx.Release.Name == $ctx.Chart.Name. When called from a parent chart's template, $ctx.Chart.Name resolves to the parent chart ("kagent"), so with release=kagent the helper returned the bare unprefixed name — the opposite of what this subchart's own templates render. Compare against the literal "substrate" instead. The hack/render-manifests.sh path (release=substrate) is unaffected, and hack/render-manifests.sh --check still passes.

2. Add three named helpers that wrap the naming scheme so consumers don't need to know it:

Helper	Resolves to
substrate.ateApiServer.serviceAccountName	<release>-ate-api-server
substrate.ateApi.endpoint	dns:///<release>-api.<namespace>.svc:443
substrate.atenetRouter.url	http://<release>-atenet-router.<namespace>.svc:80

Parent charts can then drop bare-name defaults and use e.g.

value: {{ .Values.controller.substrate.ateApiEndpoint | default (include "substrate.ateApi.endpoint" .) | quote }}

The atenet-router and ateapi Services have the same subchart-prefix problem as the SA — this PR unblocks fixing all three in one downstream change.

Test plan

• hack/render-manifests.sh --check — manifests/ate-install/ unchanged
• helm template substrate charts/substrate — bare names preserved
• helm template kagent charts/substrate — resources render as kagent-* (unchanged)
• Vendored charts/substrate into a scratch parent chart and confirmed the three named helpers resolve to kagent-ate-api-server, dns:///kagent-api.<ns>.svc:443, http://kagent-atenet-router.<ns>.svc:80 when invoked from parent-chart context with release=kagent
• Follow-up: update kagent-dev/kagent's controller-deployment.yaml and substrate-ate-api-rbac.yaml to default from these helpers, dropping the manual overrides currently required.