fix(ci): resolve lint and Helm fixture security failures

[neilime]

The newer Super-linter reports failures on generated assets, duplicated fixture/documentation content, the documentation app token, and the umbrella chart's Valkey defaults. Update the lint configuration and Helm values so the checks pass without the Docker build-token breaking change being part of this diff.

• Update the local linter image and documentation action lockfile, exclude the two oversized SVG assets from Biome, and exclude generated documentation, lockfiles, and test workflows from duplication checks while retaining the 5% threshold.
• Limit the documentation app token to its required contents and pull-request write permissions.
• Use Valkey's supported security/resource settings for both application and init containers, pin its image digest, and enable a readiness probe and a network policy.
• Replace the obsolete Trivy exceptions with the namespace exception, and baseline only the four upstream Valkey namespace findings in Checkov. Other namespace and resource checks remain enabled.

Stacked on #914: merge that breaking-change PR first, then retarget this PR to main. The diff here contains only the remaining nine lint-fix files.

Validation: make ci and strict Helm lint pass in a clean checkout with locked chart dependencies installed; validation leaves the checkout unchanged. Rendered-manifest checks verified the Valkey settings, and negative controls confirmed other namespace violations and Valkey resource-limit violations still fail security checks.

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter