Add ArtifactHub repository metadata and improve Helm chart configuration

- Introduced artifacthub-repo.yml for ownership verification on ArtifactHub.
- Updated release-chart.yaml to publish the ArtifactHub metadata as an OCI artifact.
- Bumped chart version to 0.2.2 and added relevant changes to Chart.yaml.
- Enhanced job-reconcile.yaml by adding a writable /tmp directory for the reconcile job.

charts/aptly/Chart.yaml

@@ -5,7 +5,7 @@ description: >-
   an nginx read/auth sidecar, a fully aptly-native values API, and declarative
   repo/mirror/publish state reconciled via a Helm hook.
 type: application
-version: 0.2.1
+version: 0.2.2
 appVersion: "1.6.3-1"
 home: https://git.morlana.online/f.weber/aptly-containerized
 sources:
@@ -32,5 +32,7 @@ annotations:
     fingerprint: FC35C0FAA26605C4C21C7BBFBF43884145E5AA94
     url: https://git.morlana.online/f.weber/aptly-containerized/raw/branch/main/pubkeys/chart-signing.asc
   artifacthub.io/changes: |
+    - kind: added
+      description: Repository ownership verification for ArtifactHub (charts/aptly/artifacthub-repo.yml), published as a companion OCI artifact by release-chart.yaml.
     - kind: fixed
-      description: The aptly container's startup/readiness/liveness probes now exec curl against 127.0.0.1 instead of using httpGet. httpGet probes are dialed by kubelet against the pod IP, not localhost — since aptly listens on 127.0.0.1 only (by design, see proxy.enabled), that connection was always refused, leaving the pod stuck failing its startup probe forever despite aptly actually being healthy.
+      description: The reconcile Job's container had readOnlyRootFilesystem but no writable /tmp, so its own API client's scratch files failed to write ("Read-only file system") and every reconcile call died with a misleading "connection" error. A /tmp emptyDir is now mounted there too, matching the aptly/nginx containers in the StatefulSet.