refactor: redesign E2E to use custom Docker image instead of PVC/kubectl

Replace the PVC + kubectl-patch approach for E2E plugin deployment with
a custom Docker image that has the plugin pre-installed. This eliminates
all policy-violating operations:

- No PVCs in kube-system
- No kubectl exec/cp to Headlamp pods
- No deployment patching via kubectl
- No temporary pods or ConfigMap-based file transfers

The new approach builds a Headlamp image with the plugin baked in
(Dockerfile.e2e), deploys it as a dedicated instance in the headlamp-e2e
namespace via Helm, and tears it down after tests complete.

RBAC is scoped to the headlamp-e2e namespace instead of kube-system.

Note: .github/workflows/e2e.yaml still needs updating to use the new
scripts — that change is delegated to Hugh (CI/CD owner).

Closes: privilegedescalation/headlamp-polaris-plugin#72

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deployment/headlamp-e2e-values.yaml

@@ -1,22 +1,23 @@
 ---
-# Headlamp Helm values for E2E testing with shared volume plugin deployment.
+# Headlamp Helm values for E2E testing.
 #
-# The CI runner and Headlamp pod share a PVC so that the runner can copy
-# built plugin artifacts directly into Headlamp's plugins directory.
-# This is a CI-only mechanism — production plugin distribution uses ArtifactHub.
+# Uses a custom Docker image (built from Dockerfile.e2e) with the plugin
+# pre-installed. No PVCs, no volume mounts, no deployment patching.
+#
+# The E2E workflow builds the image, pushes to ghcr.io, and deploys this
+# Helm release in the headlamp-e2e namespace.
+#
+# Usage:
+#   helm install headlamp-e2e headlamp/headlamp \
+#     -n headlamp-e2e --create-namespace \
+#     -f deployment/headlamp-e2e-values.yaml \
+#     --set image.registry=ghcr.io \
+#     --set image.repository=privilegedescalation/headlamp-polaris-e2e \
+#     --set image.tag=<sha>
 
-# Point Headlamp at the shared plugins mount
 config:
   pluginsDir: /headlamp/plugins
+  watchPlugins: false
 
-# PVC-backed volume shared with the CI runner
-volumes:
-  - name: plugins
-    persistentVolumeClaim:
-      claimName: headlamp-plugins
-
-# Mount into the Headlamp container
-volumeMounts:
-  - name: plugins
-    mountPath: /headlamp/plugins
-    readOnly: true
+service:
+  type: ClusterIP