feat(skaha): consume usage metrics and align Helm deployment

[shinybrar]

Moves Skaha platform statistics and optional backend session usage to the versioned Metrics API. Platform statistics reject unavailable or non-ready reports; Session usage uses bounded fan-out and cancels outstanding work at the aggregate deadline.

This is the Skaha portion of #1175, stacked on #1181 (feat/usage-metrics-api). It contains the Java consumers and tests, session labeling changes, root Helm deployment configuration and integration ADRs. Merge the Metrics PR first, then rebase only this PR's commits onto main, retarget this PR and rerun its checks.

The Helm test now requires the namespaced Job, Pod and PodMetrics reads needed by Session reports. It also verifies that ClusterQueue access remains restricted to named queues with get, and that Job/Pod access is absent from the ClusterRole. Linting, testing and CodeQL workflows now run for PRs targeting a feature branch.

Validation:

• Reproduced the obsolete no-Pod-permissions assertion; the corrected Helm rendering suite passes.
• Split audit: 42 changed paths in this PR, no overlap with the Metrics PR, and no omitted paths from the original PR. Three paths are additional CI trigger changes needed for stacking.
• Metrics pre-commit hooks and repository file/secret checks passed on the combined tree.
• All hosted checks passed, including Java/Helm tests, pre-commit, Spotless, CodeQL, commit-check and coverage upload.
• Full repository pre-commit passed in a standalone checkout on JDK 21, including Gradle clean/check, Checkstyle and Spotless. All 153 Java tests passed. The standalone checkout avoids a local Spotless limitation with linked-worktree Git metadata.

The API cutover requires matching Metrics and Skaha versions. Release the matching images and shared Helm configuration together after both PRs are ready.