feat(shield): add host.profiles for per-node-type resource sizing

[aaronm-sysdig]

What this PR does / why we need it

Adds an optional host.profiles list to the shield chart so a single Helm release can deploy one right-sized host shield DaemonSet per node type, instead of forcing one resource config across a mixed-node cluster.

On clusters with heavy and light nodes, a single host.resources block means you either size for the heaviest node (wasting resources on the light ones) or size for the lightest (risking OOMKilled/throttling on the heavy ones). host.profiles lets each node type get its own DaemonSet with its own resources, pinned by nodeSelector.

How it works

Each profile deep-merges its overrides (resources, node_selector, affinity, tolerations) over the base host.* settings, and renders one DaemonSet. The Kubernetes scheduler handles placement at runtime via nodeSelector - Helm doesn't need to know anything about the nodes.

Everything else (RBAC, ConfigMap, Secrets, cluster Deployment) stays singular - only the host DaemonSet multiplies.

Already in production

A customer is already running this from a fork across mixed node types, targeting Karpenter/instance-type labels, including an "else default" catchall profile (empty node_selector + NotIn node affinity) to guarantee coverage of un-profiled nodes. It targets nodes as expected.

Backward compatibility

host.profiles defaults to []. When empty, the chart renders exactly as before - a single host DaemonSet with the same name and no extra labels. Existing installs are unaffected until profiles are explicitly set.

Scope / notes

• Linux host only. daemonset-windows.yaml is intentionally untouched.
• No Chart.yaml version bump or README.md regen - left out deliberately so this can be folded into your next release cut without version/README conflicts. values.yaml carries the documented value so make docs will pick it up when you regenerate.
• Per-profile DaemonSets get a sysdig/host-profile: <name> label (selector + pod), matching the chart's existing sysdig/* label convention.

Testing

• helm unittest --strict green: backward-compat (empty → 1 DaemonSet, default name, no profile label) + multi-profile merge (per-profile resources, node selectors, inherited base values).
• helm lint clean.
• Verified live: 3 DaemonSets (large/medium/small) with distinct resources, correct node pinning, singular cluster components.

Checklist

• Title starts with type and scope
• Chart Version bumped (intentionally omitted - see notes above)
• Variables documented in values.yaml (README regen left to release cut)
• Check GithubAction checks
• Test files under tests/ with _test suffix

[github-actions]

Hi @aaronm-sysdig. Thanks for your PR.

After inspecting your changes someone with write access to this repo needs
to approve and run the workflow.