[Feature]: Add configurable policy CronJob helm templates to the dirctl chart

[paralta]

Problem Statement

Admins can already apply node-level content policies — "sync every record carrying a given
domain", "drop records that aren't signed by a given identity" — by composing dirctl calls
on a schedule. What's missing is any chart support, so every deployment hand-rolls the same
wiring.

The chart is close but can't get there. install/charts/dirctl/values.yaml has a generic
cronjobs map with per-entry env/volumes/volumeMounts, and templates/configmaps.yaml
already renders arbitrary ConfigMaps. What's missing is the ability to run anything other
than a single command: templates/cronjob.yaml templates only args, never command, so
no pipe, loop, or conditional is expressible. Its four example entries (search, lookup,
push, import-mcp) are one-shot demos, not policies.

So a policy today means a forked chart or hand-written manifests, plus a custom image and
ConfigMap wiring, with no guidance from the project on getting the details right.

Proposed Solution

Ship policy CronJob templates in the dirctl chart that an admin enables and configures from
values.yaml — no forked chart, no hand-written scripts. Parameterised over the predicate
and the action rather than hardcoded per policy, so admins can express their own policies,
not just the ones we thought of.

Roughly:

policies:
  sync-netsec:
    enabled: true
    schedule: "0 3 * * *"
    match: { domain: ["network_security"] }
    action: sync
  prune-untrusted:
    enabled: true
    schedule: "*/30 * * * *"
    match: { trusted: false, scanSeverity: MEDIUM }
    action: prune

Exact schema and how far to generalise the predicate are open. The bar is that the two
policies above work end to end from values alone, and that adding a third doesn't need a
chart change.

Underneath, this needs the chart to run a script rather than a single command — command
support in templates/cronjob.yaml at minimum — and a shell-capable dirctl image
(tracked separately).

Alternatives Considered

No response

Additional Context

No response

Checklist

• I have read the contributing guidelines
• I have verified this does not duplicate an existing feature request