fix: thread secret annotations and labels through new helm charts

The new config and pull secret helm releases need to honor user-set annotations and labels for `--resource-type secret` so existing scheduler-k3s annotation tests keep passing. The dedicated charts now render `.Values.global.annotations` and `.Values.global.labels` onto their Secret manifest, and the deploy trigger plumbs `SecretAnnotations` and `SecretLabels` from the global annotation/label config. The rollback regression bats test now uses `dokku ps:rebuild` for its second deploy because git push of an unchanged ref is rejected by the dokku remote.

tests/unit/scheduler-k3s-secrets-deploy.bats

@@ -44,7 +44,12 @@ teardown() {
   echo "status: $status"
   assert_success
 
-  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP"
+  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "sleep 30"
   echo "output: $output"
   echo "status: $status"
   assert_success