[Feature]: Support imagePullSecrets on hoopagent-chart

Is your feature request related to a problem?

Yes. hoopagent-chart lets us override image.repository / image.tag and create a ServiceAccount (serviceAccount.create, serviceAccount.annotations), but it has no way to attach imagePullSecrets to either the ServiceAccount or the pod spec.

That is a problem when the agent image comes from a private registry. Helm applies the Deployment and waits for the rollout (atomic / --wait) before anything else can patch the ServiceAccount, so the first pods fail with ImagePullBackOff and the release rolls back.

Today we work around it by Helm-postrendering imagePullSecrets onto the ServiceAccount the chart creates. That works, but it is brittle and should not be required.

Describe the solution you'd like

Add a first-class values field, for example:

imagePullSecrets: []
# - name: docker-cfg

serviceAccount:
  create: false
  annotations: {}
  imagePullSecrets: []
  # - name: docker-cfg

and render it on the ServiceAccount (preferred, so every pod using hoopagent inherits it) and/or on spec.template.spec.imagePullSecrets in the Deployment.

Same pattern as most application charts. The chart should not create the dockerconfigjson Secret itself — just reference secrets that already exist in the namespace.

Describe alternatives you've considered

• Post-render / kubectl patch the ServiceAccount after install. Too late if Helm waits for the Deployment to become ready.
• Cluster-wide default ServiceAccount pull secrets. Too broad, and many clusters do not allow it.
• Public images only. Not an option when the agent image is private.

Additional context

Chart in question: oci://ghcr.io/hoophq/helm-charts/hoopagent-chart (deploy/helm-chart/chart/agent). Current templates only expose serviceAccount.create and serviceAccount.annotations; serviceaccount.yaml and deployment.yaml never emit imagePullSecrets.

Happy to send a PR if that helps.

Franklin Garcia Paragon