fix(infra): render CONVOY_RETENTION_POLICY independently of retention_policy.enabled

[mekilis]

Summary

Both retention env vars sat behind retention_policy.enabled, but the server stopped reading that flag for partition retention. Deletion is gated on the license alone, while enabled now gates archiving and backup only. An operator who set a custom duration and left enabled false had the duration dropped from the pod spec, so a licensed instance deleted at the server's own 720h default instead of the configured value. Silent, and in the wrong direction: history goes away sooner than configured.

The duration is wrapped in with rather than rendered unconditionally, because an empty value is worse than an absent one. The worker runs time.ParseDuration on it and returns an error, so an empty policy would stop the pod booting instead of falling back to the default.

CONVOY_RETENTION_POLICY_ENABLED now renders in both states rather than only when true. Behaviour is identical today, since absent and false both resolve to false, but the rendered manifest states what it means and cannot drift if the server default changes.

extraEnvs still renders after this block in all four templates and Kubernetes takes the last duplicate, so anyone working around this with extraEnvs today keeps their override.

Values comments record that enabled does not stop deletion, which is the reading that produced the wrong configuration in the first place. They are plain comments rather than helm-docs directives, so README.md stays valid without regenerating it.

No chart version bump, following the convention that release prep is its own PR.

Test plan

helm lint passes on all three charts and scripts/verify-redis-sentinel-template.sh reports OK.

Rendered for server and agent, over both the deployment and rollout paths:

• enabled=false with policy=2160h now emits the duration, which is the bug this fixes:

- name: CONVOY_RETENTION_POLICY
  value: "2160h"
- name: CONVOY_RETENTION_POLICY_ENABLED
  value: "false"

• an empty policy omits the var entirely rather than sending "", so the pod still boots and the server default applies:

- name: CONVOY_RETENTION_POLICY_ENABLED
  value: "false"

Renders are otherwise byte-identical to main apart from the pod annotation Helm stamps on every render.

[cursor]

Current version of PR was reviewed by /review-bugbot on Aug 13, 14:51 GMT+1. It flagged 0 findings.

^{Bugbot on commit d048093 is skipped.}