feat(helm): dual-mode nullify-k8s-collector for EKS and GKE

[vik-nullify]

Summary

Extends the existing nullify-k8s-collector Helm chart so the same collector image deploys to both EKS and GKE with a single cloudProvider: aws|gcp values switch. EKS stays the default — existing deployments upgrade with no values changes.

On GKE the chart wires up AWS's OIDC-federation story in reverse: GKE Workload Identity → accounts.google.com ID token → sts:AssumeRoleWithWebIdentity → short-lived AWS creds → S3. No long-lived AWS credential is ever stored in the customer cluster.

What's in this PR

Chart (helm-charts/nullify-k8s-collector/)

• values.yaml — new top-level cloudProvider key (aws default) and a collector.gke subsection holding nullifyAwsRoleArn, audience, webIdentityTokenPath.
• templates/serviceaccount.yaml — renders only the annotation that matches the selected provider (eks.amazonaws.com/role-arn for AWS, iam.gke.io/gcp-service-account for GCP). Extra custom annotations pass through unchanged.
• templates/cronjob.yaml — adds AWS_WEB_IDENTITY_TOKEN_FILE / NULLIFY_AWS_ROLE_ARN env vars and a projected service-account-token volume (audience sts.amazonaws.com) when running on GKE.
• templates/NOTES.txt — post-install notes show the active provider and the right auth summary.
• README.md — new Supported platforms table and a GKE with Workload Identity Federation section with the full onboarding runbook (create GCP SA → share uniqueId with Nullify → bind via workloadIdentityUser → install chart).
• values-example.yaml — commented GKE example at the bottom alongside the existing EKS example.
• Chart.yaml — bump 0.1.2 → 0.2.0.

Top-level README

• Minor edits in What's Included, Deployment Options, Prerequisites, and Component Overview rows to reflect that the chart now supports both platforms. Everything else is unchanged.

Backwards compatibility

• cloudProvider defaults to aws, so the rendered EKS output is byte-for-byte identical to 0.1.2 except for chart-version labels.
• Verified with helm template that default (EKS) mode renders no GKE fields (iam.gke.io, NULLIFY_AWS_ROLE_ARN, AWS_WEB_IDENTITY_TOKEN_FILE, projected token volume) — clean isolation.

Test plan

• helm lint helm-charts/nullify-k8s-collector/ — passes.
• helm template test helm-charts/nullify-k8s-collector/ (default EKS mode) — renders the expected CronJob + SA with only the EKS annotation and no WIF wiring.
• helm template test helm-charts/nullify-k8s-collector/ --set cloudProvider=gcp ... — SA has only the iam.gke.io/gcp-service-account annotation, CronJob has both WIF env vars and the projected token volume with audience sts.amazonaws.com.
• Install against a real GKE cluster and verify sts:AssumeRoleWithWebIdentity succeeds and the collector uploads to S3 (blocked on the Nullify-side federated IAM role landing — see the companion backend PR in the monorepo).

Follow-ups (not in this PR)

• Customer-side GCP Terraform module under gcp-integration-setup/ that creates the GCP service account, binds it to the in-cluster ServiceAccount via Workload Identity, and outputs the uniqueId for the customer to share with Nullify. Today the chart README documents the equivalent gcloud commands.