Share PostgreSQL with Substrate

[iplay88keys]

Note

This PR requires a substrate chart containing this PR: kagent-dev/substrate#32

Summary

• Default embedded Substrate to the same PostgreSQL database as Kagent, using the substrate schema.
• Disable Substrate's bundled PostgreSQL so the default installation creates only Kagent's bundled database.
• Create a release-scoped Secret from either database.postgres.url or Kagent's bundled PostgreSQL URL.
• Replace database.postgres.urlFile with database.postgres.secretRef.{name,key}.
• Keep database ownership explicit: Kagent reads database.postgres.*, while Substrate reads substrate.postgres.*.
• Allow both charts to reference the same existing Secret, or let Substrate use an independent literal or Secret-backed connection.
• Document bundled, shared external, and separate Substrate PostgreSQL configurations, duplicated here:

Substrate PostgreSQL

Enabling Substrate uses Kagent's bundled PostgreSQL by default. Kagent and
Substrate share the database connection but use separate schemas.

substrate:
  enabled: true

To share an external PostgreSQL connection, configure it once for Kagent:

database:
  postgres:
    url: postgresql://user:password@database:5432/kagent
    bundled:
      enabled: false
substrate:
  enabled: true

To share an existing Secret, configure both charts to reference the same
name and key:

database:
  postgres:
    secretRef:
      name: shared-postgres
      key: connectionString
    bundled:
      enabled: false
substrate:
  enabled: true
  postgres:
    connectionStringSecretRef:
      name: shared-postgres
      key: connectionString

To give Substrate a separate PostgreSQL connection, disable sharing and set
the Substrate connection directly:

substrate:
  enabled: true
  postgres:
    connectionString: postgresql://user:password@substrate-db:5432/substrate
    connectionStringSecretRef:
      enabled: false

For a separate Secret-backed connection, leave enabled: false and set
connectionStringSecretRef.name and key.

Dependency

This requires a Substrate chart release containing postgres.connectionStringSecretRef. Update Kagent's Substrate dependency to that release before merging.

Testing

• helm unittest helm/kagent — 286 tests passed
• helm lint helm/kagent
• go test ./core/internal/database ./core/pkg/app
• Rendered bundled, external URL, shared existing Secret, and separate Substrate database configurations
• Verified the removed urlFile value fails with migration guidance