feat(self-managed): expose ICMS and NVCT environment overrides

[sbaum1994]

Description

The self-managed stack generates chart values for the sis and nvct-api
releases. The underlying charts accept arbitrary service environment maps as
sis.env and nvctApi.env, but the stack currently emits fixed environment
entries without merging operator-provided values from the selected stack
environment.

Upgrade procedures need to enable bounded, service-owned data tasks through
environment variables. Example controls include an NVCT health backfill mode
and an ICMS instance lookup backfill mode. Without stack-level passthrough,
operators must use transient Helmfile overrides or mutate the Deployment with
kubectl, which creates configuration drift that a later Helm sync can erase.

Expose generic, non-secret environment overrides for both services. Keep the
task-specific variables owned and validated by their respective services.

Definition of Done

• Add an empty nvctApi.env map to the base stack environment.
• Add an empty icms.env map to the base stack environment.
• Validate that both values are maps and fail rendering with a useful message
  when either has another type.
• Merge nvctApi.env over the stack-generated NVCT defaults and render the
  result as chart value nvctApi.env.
• Merge icms.env over the stack-generated ICMS defaults and render the result
  as chart value sis.env.
• Give operator values last-write precedence so an explicit environment value
  can override a generated non-secret default without duplicate YAML keys.
• Preserve the chart ConfigMap checksum behavior so an environment change
  causes a rolling Deployment update.
• Add rendering tests for both services, including a new key, overriding an
  existing key, an empty map, and invalid non-map input.
• Document that these maps are for non-secret settings and that secrets must
  remain in the supported secret configuration path.
• Document a temporary upgrade procedure using release-scoped Helmfile values
  overrides until environment-level passthrough is available.

Resources (optional)

• Self-managed stack values template
• Self-managed base environment
• NVCT chart Deployment
• ICMS chart Deployment
• Upgrade documentation work