[DYNAMO] feat(helm): tolerations, imagePullSecrets, configMap mount

[AmeenP]

Summary

Adds three commonly-needed knobs to the prime-rl Helm chart, all opt-in. Verified with helm template: rendered output is byte-identical to current main when defaults are used.

• <component>.tolerations on orchestrator / inference / trainer — schedule onto tainted nodes (dedicated GPU pools, spot/preemptible nodes, etc.) without forking the chart.
• <component>.imagePullSecrets so private-registry images can be pulled without baking secrets into the namespace's default ServiceAccount.
• orchestrator.configMap mounts an existing ConfigMap at /configs in the orchestrator container, so TOML configs can be shipped without rebuilding the image.

Also quotes the command arg in autoStart mode so multi-line shell strings don't break YAML parsing — this was a bug waiting to happen.

The orchestrator's volumeMounts / volumes blocks are now gated on storage.enabled OR configMap so we don't emit empty lists when both are off (the naive version would render volumes: with no items, which kubectl rejects).

Verification

helm template t k8s/prime-rl > /tmp/defaults.yaml                # 421 lines, identical to main
helm template t k8s/prime-rl --set 'orchestrator.configMap=cm' \
  --set 'orchestrator.tolerations[0].key=nvidia.com/gpu' \
  --set 'orchestrator.imagePullSecrets[0].name=regcred' > /tmp/over.yaml  # 433 lines, fields land correctly

[samsja]

Closing this older Dynamo PR as superseded by the current integration effort in #3062 and the split PR series #3174–#3180. Thanks for the work here.