helm upgrade --reuse-values to 0.3.6 fails: nil pointer on patchmon.session.secret #10

Summary

helm upgrade --reuse-values from any chart ≤ 0.3.5 to 0.3.6 fails to render:

Error: UPGRADE FAILED: template: patchmon/templates/secret.yaml:45:75:
executing "patchmon/templates/secret.yaml" at <.Values.patchmon.session.secret>:
nil pointer evaluating interface {}.secret

Hit upgrading a live 0.3.2 release to 0.3.6. The failure is at template render, so
nothing is applied and the release is untouched — but the upgrade cannot proceed.

Cause

#7 added these dereferences to templates/secret.yaml:

SESSION_SECRET:    {{ default (randAlphaNum 64) (default $oldSession .Values.patchmon.session.secret) | quote }}
AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) (default $oldAiKey  .Values.patchmon.encryption.aiKey) | quote }}

--reuse-values reuses the previous release's values and does not merge in defaults
newly added by the incoming chart. A release created on ≤ 0.3.5 has a patchmon map
containing jwt, oidc, etc. but no session or encryption key, so both parent maps
are nil and the dereference fails.

Confirmed on the affected release:

$ helm get values patchmon -n patchmon | grep -A2 -E "^  (jwt|session|encryption):"
  jwt:
    expiresIn: 1h
    refreshExpiresIn: 7d
      # no session:, no encryption:

This is not an exotic path — --reuse-values is the normal way to upgrade a release
whose values live outside git, and every existing user is on ≤ 0.3.5 by definition.
patchmon.jwt.secret is safe only because jwt already existed before #7.

Workaround

Supply the missing parents explicitly. Empty values fall through to the lookup, so the
existing secrets are preserved:

helm upgrade patchmon <repo>/patchmon --version 0.3.6 -n patchmon --reuse-values \
  --set patchmon.session.secret="" \
  --set patchmon.encryption.aiKey=""

Verified: upgrade completed, and JWT_SECRET/SESSION_SECRET/AI_ENCRYPTION_KEY/
OIDC_CLIENT_SECRET all hashed identical before and after.

Fix

Make the lookups nil-safe, e.g. with dig:

{{- $sessionVal := dig "session" "secret" "" .Values.patchmon }}
{{- $aiKeyVal   := dig "encryption" "aiKey" "" .Values.patchmon }}
...
  SESSION_SECRET:    {{ default (randAlphaNum 64) (default $oldSession $sessionVal) | quote }}
  AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) (default $oldAiKey  $aiKeyVal)   | quote }}

Worth auditing the other templates for the same pattern — any value added to an existing
map in a later chart version has this problem under --reuse-values.

Also worth a ct lint-level guard if practical: the current PR check installs the chart
fresh, which passes, and would not have caught an upgrade-path regression.