Reject invalid deployment configuration early

tests/kind/run-deployment.sh

@@ -376,6 +376,17 @@ rollout_remora() {
   done
 }
 
+reject_chart_values() {
+  local reason="$1"
+  shift
+  if helm template remora "$ROOT/deploy/charts/remora" \
+    --namespace "$FIXTURE_NAMESPACE" \
+    "$@" >/dev/null 2>&1; then
+    printf 'chart accepted %s\n' "$reason" >&2
+    return 1
+  fi
+}
+
 validate_deployment_assets() {
   local chart="$ROOT/deploy/charts/remora"
   helm lint "$chart"
@@ -392,12 +403,20 @@ validate_deployment_assets() {
   grep -q 'absent(remora_ready{component="remora-worker"})' "$RUNTIME/deployment-policy-rendered.yaml"
   grep -q 'automountServiceAccountToken: false' "$RUNTIME/deployment-policy-rendered.yaml"
   grep -q 'readOnlyRootFilesystem: true' "$RUNTIME/deployment-policy-rendered.yaml"
-  if helm template remora "$chart" \
-    --namespace "$FIXTURE_NAMESPACE" \
-    --set target.exclusiveWriter=false >/dev/null 2>&1; then
-    printf 'chart accepted an unprotected target namespace\n' >&2
-    return 1
-  fi
+  reject_chart_values "an unprotected target namespace" --set target.exclusiveWriter=false
+  reject_chart_values "an unknown top-level value" --set unexpected=true
+  reject_chart_values "an unknown nested value" --set runtime.unexpected=true
+  reject_chart_values "a zero lease TTL" --set coordination.leaseTtlSeconds=0
+  reject_chart_values "an invalid OIDC issuer" --set-string oidc.issuer=identity.invalid
+  reject_chart_values "an invalid target bucket" --set-string target.bucket=two..dots
+  reject_chart_values "an out-of-range source port" \
+    --set-string outbound.allowedSchemePorts=https:70000
+  reject_chart_values "renewal at lease expiry" \
+    --set runtime.workerRenewSeconds=30
+  reject_chart_values "application-only CIDR reachability" \
+    --set-string outbound.allowedCidrs=10.0.0.0/8
+  reject_chart_values "an impossible disruption budget" \
+    --set podDisruptionBudget.minAvailable=3
   if grep -R -E \
     '(BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY|postgres://[^[:space:]]+:[^[:space:]]+@|VAULT_TOKEN[=:][^$])' \
     "$chart" "$ROOT/docs/spec" >/dev/null; then