fix: helm test-connection supports all TLS modes

[tgarciai]

Summary

The helm test pod was hardcoded to wget http:// — broke when tls.mode=server|mutual.

Now adapts per mode:

• disabled: wget (busybox) — unchanged
• server: curl --cacert with CA from TLS secret — verifies certificate chain
• mutual: nc -z TCP check — same strategy as kubelet tcpSocket probes

Cluster evidence

$ helm test underpass-runtime -n underpass-runtime
TEST SUITE:     underpass-runtime-test-connection
Phase:          Succeeded

$ kubectl logs underpass-runtime-test-connection
{"status":"ok"}

Test plan

• helm lint — clean
• helm template renders correctly for disabled/server/mutual
• helm test passed on live cluster with tls.mode=server

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud