[codex] Split infrastructure and application Helm releases

[hhhhsc701]

What changed

• Move Elasticsearch, PostgreSQL, Redis, and MinIO into a dedicated nexent-infrastructure chart and release.
• Keep application services in the nexent release.
• Add --release-scope all|infrastructure|nexent deployment and uninstall flows, dependency protection, readiness ordering, and Elasticsearch API key initialization before application installation.
• Update Kubernetes documentation, offline packaging, and Helm/deployment tests.

Why

The previous deployment upgraded one umbrella release twice while waiting for Elasticsearch and initializing its API key, which restarted all application containers during first installation.

Impact

Fresh Kubernetes deployments now create two Helm releases. Legacy single-release deployments are detected and rejected; automatic migration is not included.

Validation

• bash -n passed for deploy, Elasticsearch initialization, and uninstall scripts.
• 16 deployment tests passed.
• 14 Helm-rendering tests are blocked by the local snap Helm environment (cannot create transient scope / exit 46), not by chart assertions.
• git diff --check passed.

Known follow-up

• --release-scope nexent still needs to reuse the PostgreSQL password from nexent-infrastructure-secrets when the local .env differs.

Stack

Stacked on dev/multi-pod-business; review this PR against that branch.