WS-D.1: Helm chart-invariant render gate (.client-ref) + extend client check-drift.sh

[LukasWodka]

Part of epic tracebloc/backend#1106. Full spec: report §5 (mirrored on the epic; artifact https://claude.ai/code/artifact/b4b6e6a6-4d76-4e46-a668-6f4f0f944344). WS-D.1: cli-side CI job (weekly + on internal/cluster|doctor change) checks out tracebloc/client @ new pinned scripts/.client-ref, runs helm template, asserts all 8 invariants (payload = the 5 unguarded: Service jobs-manager:8080, client-pvc + /data/shared, ingestion-authz ConfigMap, INGESTOR_IMAGE_DIGEST, submit path). Second half: PR to client extending scripts/tests/check-drift.sh with the CLI-assumed names so chart PRs fail at source.

[LukasWodka]

Shipped in #311 (merged to develop). Closing as completed — CLI refactor epic backend#1106 cleanup.