feat(observability): add prometheus operator servicemonitor to the helm charts

[tiana-code]

Adds a Prometheus Operator ServiceMonitor to the ledger and payments Helm charts (E-07, #249).

What

• New templates/servicemonitor.yaml in both charts, gated behind serviceMonitor.enabled (default false in values.yaml). When enabled it selects the service via matchLabels = <chart>.selectorLabels and scrapes the named http port at /actuator/prometheus on a configurable interval.
• The payments /actuator/prometheus permit was already added in F-07.6 docker-compose observability profile #250, so this slice is templates only.

CI safety

• The default helm template render (no flag) emits no ServiceMonitor, so the existing kubeconform -strict step is unchanged and green (it never needs the operator CRD schema).
• A new step renders with --set serviceMonitor.enabled=true, asserts kind: ServiceMonitor is present (non-vacuous), and runs kubeconform -strict -skip ServiceMonitor - catching template errors and validating the rest without a network CRD-schema fetch.

Gate chain

• critic: GO-WITH-CHANGES (the flag-on render assertion was added; matchLabels-subset confirmed).
• security-auditor (opus): PASS - no secrets, no Actions injection (only matrix.chart interpolated), off-by-default, §5.3 clean.
• code-reviewer: its lone must-fix (add namespaceSelector) was rejected with evidence - the chart co-locates the ServiceMonitor and the Service in the release namespace, so an omitted selector already discovers it; matchNames: [release-namespace] is functionally identical to the default, and exemplary charts default to empty.
• evaluator: PASS (0.89 >= 0.80).
• helm/kubeconform unavailable locally; the binding check is the CI helm-test job.

Closes #249