feat(chart): render extraManifests and serviceMonitor

[tlongwell-block]

What

Render the extraManifests and serviceMonitor values. Both are declared in values.yaml and values.schema.json, but no template consumed either — so setting them produced no output. That's a silent no-op: the chart looks configured but ships nothing, which is easy to miss in review.

Why

The Coder/tf-stacks Buzz deploy needs to attach companion Istio mesh objects (VirtualService, Sidecar, ServiceEntry, mesh Service) and a Prometheus ServiceMonitor alongside the relay. extraManifests is the standard escape hatch for the former; serviceMonitor already existed for the latter. Making them actually render lets that deploy stay on the official chart verbatim instead of forking it or wrapping it in an umbrella chart.

Changes (3 new files, no edits to existing templates)

• templates/extramanifests.yaml — ranges over .Values.extraManifests, runs each entry through tpl (so entries can reference release values/helpers like {{ include "buzz.fullname" . }}) and emits it as its own document.
• templates/servicemonitor.yaml — Prometheus Operator ServiceMonitor, gated on serviceMonitor.enabled. Selects the relay Service by the chart's selector labels (name + instance) — the subset the Service actually carries in its metadata.labels — and scrapes the named metrics port.
• tests/extras_test.yaml — helm-unittest coverage: empty defaults emit nothing; an extraManifests entry tpl-resolves release values; the ServiceMonitor is omitted unless enabled, and when on it selects the right labels and scrapes the metrics port.

Note on the ServiceMonitor selector

A ServiceMonitor matches a Service by the Service's metadata.labels. The relay Service's metadata labels (buzz.labels) carry name + instance but not app.kubernetes.io/component: relay — that component label only appears in the Service's spec.selector. So the selector here uses buzz.selectorLabels, not buzz.relaySelectorLabels; using the relay selector would have matched zero Services (the same silent-no-op class this PR fixes). The chart renders exactly one Service, so name+instance is a precise match.

Verification

• helm template renders both; empty defaults produce zero objects.
• ServiceMonitor selector verified against the rendered Service's metadata.labels (matches).
• helm unittest . — 32 tests / 7 suites green.
• helm lint clean.