fix(helm): namespace app-specific global values under global.seaweedfs (#8700)

* fix(helm): namespace app-specific values under global.seaweedfs

Move all app-specific values from the global namespace to
global.seaweedfs.* to avoid polluting the shared .Values.global
namespace when the chart is used as a subchart.

Standard Helm conventions (global.imageRegistry, global.imagePullSecrets)
remain at the global level as they are designed to be shared across
subcharts.

Fixes seaweedfs/seaweedfs#8699

BREAKING CHANGE: global values have been restructured. Users must update
their values files to use the new paths:
- global.registry → global.imageRegistry
- global.repository → global.seaweedfs.image.repository
- global.imageName → global.seaweedfs.image.name
- global.<key> → global.seaweedfs.<key> (for all other app-specific values)

* fix(ci): update helm CI tests to use new global.seaweedfs.* value paths

Update all --set flags in helm_ci.yml to use the new namespaced
global.seaweedfs.* paths matching the values.yaml restructuring.

* fix(ci): install Claude Code via npm to avoid install.sh 403

The claude-code-action's built-in installer uses
`curl https://claude.ai/install.sh | bash` which can fail with 403.
Due to the pipe, bash exits 0 on empty input, masking the curl failure
and leaving the `claude` binary missing.

Work around this by installing Claude Code via npm before invoking the
action, and passing the executable path via path_to_claude_code_executable.

* revert: remove claude-code-review.yml changes from this PR

The claude-code-action OIDC token exchange validates that the workflow
file matches the version on the default branch. Modifying it in a PR
causes the review job to fail with "Workflow validation failed".

The Claude Code install fix will need to be applied directly to master
or in a separate PR.

* fix: update stale references to old global.* value paths

- admin-statefulset.yaml: fix fail message to reference
  global.seaweedfs.masterServer
- values.yaml: fix comment to reference image.name instead of imageName
- helm_ci.yml: fix diagnostic message to reference
  global.seaweedfs.enableSecurity

* feat(helm): add backward-compat shim for old global.* value paths

Add _compat.tpl with a seaweedfs.compat helper that detects old-style
global.* keys (e.g. global.enableSecurity, global.registry) and merges
them into the new global.seaweedfs.* namespace.

Since the old keys no longer have defaults in values.yaml, their
presence means the user explicitly provided them. The helper uses
in-place mutation via `set` so all templates see the merged values.

This ensures existing deployments using old value paths continue to
work without changes after upgrading.

* fix: update stale comment references in values.yaml

Update comments referencing global.enableSecurity and global.masterServer
to the new global.seaweedfs.* paths.

---------

Co-authored-by: Copilot <copilot@github.com>

k8s/charts/seaweedfs/templates/volume/volume-servicemonitor.yaml

@@ -1,3 +1,4 @@
+{{- include "seaweedfs.compat" . -}}
 {{ $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume)  }}
 {{- range $vname, $volume := $volumes }}
 {{- $volumeName := trimSuffix "-" (printf "volume-%s" $vname) }}
@@ -5,7 +6,7 @@
 
 {{- if $volume.enabled }}
 {{- if $volume.metricsPort }}
-{{- if $.Values.global.monitoring.enabled }}
+{{- if $.Values.global.seaweedfs.monitoring.enabled }}
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -18,7 +19,7 @@ metadata:
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/instance: {{ $.Release.Name }}
     app.kubernetes.io/component: {{ $volumeName }}
-    {{- with $.Values.global.monitoring.additionalLabels }}
+    {{- with $.Values.global.seaweedfs.monitoring.additionalLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
 {{- with $volume.annotations }}

k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml

@@ -1,3 +1,4 @@
+{{- include "seaweedfs.compat" . -}}
 {{ $volumes := deepCopy .Values.volumes | mergeOverwrite (dict "" .Values.volume)  }}
 {{- range $vname, $volume := $volumes }}
 {{- $volumeName := trimSuffix "-" (printf "volume-%s" $vname) }}
@@ -58,7 +59,7 @@ spec:
       topologySpreadConstraints:
         {{ tpl (printf "{{ $volumeName := \"%s\" }}%s" $volumeName $volume.topologySpreadConstraints) $ | nindent 8 | trim }}
       {{- end }}
-      restartPolicy: {{ default $.Values.global.restartPolicy $volume.restartPolicy }}
+      restartPolicy: {{ default $.Values.global.seaweedfs.restartPolicy $volume.restartPolicy }}
       {{- if $volume.tolerations }}
       tolerations:
         {{ tpl (printf "{{ $volumeName := \"%s\" }}%s" $volumeName $volume.tolerations) $ | indent 8 | trim }}
@@ -76,7 +77,7 @@ spec:
         {{- if $volume.idx }}
         - name: seaweedfs-vol-move-idx
           image: {{ template "volume.image" $ }}
-          imagePullPolicy: {{ $.Values.global.imagePullPolicy | default "IfNotPresent" }}
+          imagePullPolicy: {{ $.Values.global.seaweedfs.imagePullPolicy | default "IfNotPresent" }}
           command: [ '/bin/sh', '-c' ]
           args: [ '{{range $dir :=  $volume.dataDirs }}if ls /{{$dir.name}}/*.idx  >/dev/null 2>&1; then mv /{{$dir.name}}/*.idx /idx/ ; fi; {{end}}' ]
           volumeMounts:
@@ -104,7 +105,7 @@ spec:
       containers:
         - name: seaweedfs
           image: {{ template "volume.image" $ }}
-          imagePullPolicy: {{ default "IfNotPresent" $.Values.global.imagePullPolicy }}
+          imagePullPolicy: {{ default "IfNotPresent" $.Values.global.seaweedfs.imagePullPolicy }}
           env:
             - name: POD_NAME
               valueFrom:
@@ -121,7 +122,7 @@ spec:
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" $ }}"
             {{- $mergedExtraEnvironmentVars := dict }}
-            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" $.Values.global "component" $volume "target" $mergedExtraEnvironmentVars) }}
+            {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" $.Values.global.seaweedfs "component" $volume "target" $mergedExtraEnvironmentVars) }}
             {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
             {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
@@ -145,7 +146,7 @@ spec:
                 {{- if $volume.loggingOverrideLevel }}
                 -v={{ $volume.loggingOverrideLevel }} \
                 {{- else }}
-                -v={{ $.Values.global.loggingLevel }} \
+                -v={{ $.Values.global.seaweedfs.loggingLevel }} \
                 {{- end }}
                 volume \
                 -port={{ $volume.port }} \
@@ -210,7 +211,7 @@ spec:
             - name: idx
               mountPath: "/idx/"
             {{- end }}
-            {{- if $.Values.global.enableSecurity }}
+            {{- if $.Values.global.seaweedfs.enableSecurity }}
             - name: security-config
               readOnly: true
               mountPath: /etc/seaweedfs/security.toml
@@ -332,7 +333,7 @@ spec:
           emptyDir: {}
        {{- end }}
      {{- end }}
-     {{- if $.Values.global.enableSecurity }}
+     {{- if $.Values.global.seaweedfs.enableSecurity }}
         - name: security-config
           configMap:
             name: {{ include "seaweedfs.fullname" $ }}-security-config