The frontend, gateway, provisioner, Postgres and Redis pods include
deer-flow.imagePullSecrets, but the nginx Deployment did not. With
nginx.image mirrored to a private registry, the nginx pod stayed in
ImagePullBackOff while every other pod started.
Add a helm-template test that renders every workload and checks that
each one uses the configured pull secrets and none sets them by default.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
