feat(workload): port K8s sidecar services and TLS trust-store seams (10/14)

[marceloneppel]

Issue

Part of the final charm->library migration: the K8s charm still owns the sidecar ServiceDict builders and the container TLS trust-store handling. Final state: no logic charm-side.

Solution

• K8sWorkload.push_file: the container push with the charm permissions (make_dirs/0o400/user/group). Port of _push_file_to_workload.
• K8sWorkload.sync_tls_trust_store(ca, certs_path): the can_connect guard + the CA push + update-ca-certificates. The /tmp peer CA bundle write stays charm-class-side (k8s-5) — the lib TLSManager.get_peer_ca_bundle provides the content.
• K8sWorkload.generate_ldap_service: the faithful ServiceDict env (DATABASE_PORT string literal, ACCESS_GROUP_IDENTITY from utils.postgresql), parameterized.
• K8sWorkload.generate_metrics_service: the /usr/bin/prometheus-postgres-exporter charm form + the monitoring-secret startup gate.
• Tests: tests/unit/test_k8s_workload_seams.py (5 cases, container mocked at the workload level).

Checklist

• I have added or updated any relevant documentation.
• I have cleaned any remaining cloud resources from my accounts.