refactor: relocate remaining bedag/raw helmfile releases into base chart

[bussyjd]

Why

The infrastructure helmfile shipped 6 bedag/raw releases — a wrapper chart whose only job is to apply inline YAML through helmfile. With the base release already rendering every other YAML in base/templates/, the inline approach has zero remaining justification — it's just duplicate machinery.

Before

helmfile.yaml
    ├── chart: ./base                          → renders base/templates/*.yaml
    ├── chart: bedag/raw, name: llm-buyer-podmonitor   → inline YAML in helmfile
    ├── chart: bedag/raw, name: erpc-httproute         → inline YAML
    ├── chart: bedag/raw, name: erpc-x402-middleware   → inline YAML
    ├── chart: bedag/raw, name: erpc-metadata          → inline YAML
    ├── chart: bedag/raw, name: obol-frontend-httproute→ inline YAML
    └── chart: bedag/raw, name: obol-frontend-rbac     → inline YAML

After

helmfile.yaml
    └── chart: ./base                          → renders base/templates/*.yaml
                                                 including the relocated YAML

base/templates/
    ├── erpc.yaml             (new — HTTPRoute, Middleware, ConfigMap)
    ├── obol-frontend.yaml    (new — HTTPRoute, ClusterRole, ClusterRoleBinding)
    ├── llm.yaml              (appended — litellm-x402-buyer PodMonitor)
    └── ... (rest unchanged)

What changed

• helmfile.yaml — removed all 6 bedag/raw releases; dropped the bedag repository entry (no longer referenced by infrastructure)
• base release now needs: [traefik/traefik, monitoring/monitoring] so the Middleware / HTTPRoute / PodMonitor CRDs are present when the relocated templates apply
• New base/templates/erpc.yaml carries Namespace + HTTPRoute + Middleware + metadata ConfigMap
• New base/templates/obol-frontend.yaml carries Namespace + HTTPRoute + discovery RBAC
• Appended PodMonitor block to base/templates/llm.yaml
• Deleted unused internal/embed/infrastructure/values/erpc-metadata.yaml.gotmpl
• Each relocated YAML carries a provenance comment
• TestHelmfile_IncludesBuyerPodMonitor rewired to read base/templates/llm.yaml

Why the needs: change is safe

Helmfile already serialises on needs: — making base wait for traefik + monitoring just shifts the order, not the total work. All downstream releases that previously needs: [kube-system/base] keep working unchanged.

Why the new Namespace docs are safe

erpc and obol-frontend namespaces are now created by both the base release templates AND the upstream chart releases (which keep createNamespace: true). kubectl apply on an existing Namespace is a no-op.

Test plan

• go build ./... clean
• go test ./internal/embed/... green
• go test ./internal/stack/... green (one pre-existing failure on main, unrelated: TestWarnIfNoChatModel_EmitsWarnWhenNoModels expects "No chat-capable LLM detected" but code emits "No chat-capable model detected")
• All HTTPRoute hostnames: ["obol.stack"] restrictions preserved (CLAUDE.md security guidance — frontend / eRPC must not reach the public cloudflared tunnel)
• All labels (release: monitoring, app.kubernetes.io/*) preserved on relocated docs
• Manual on next stack up: kubectl get httproute,middleware,configmap,podmonitor -A matches before-state

Notes

• bedag/raw is still referenced by network helmfiles and internal/hermes/hermes.go — out of scope for this PR. The internal/update/charts.go dedup comment is still accurate for those callers.
• migrateDefaultsHTTPRouteHostnames in stack.go targets the old in-helmfile HTTPRoute indentation; it remains a no-op against the relocated templates and the new helmfile, preserved for users upgrading from older stacks.

[bussyjd]

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.