Verify PodMonitor metrics relationships in CI

The chart can render one PodMonitor that selects the controller, cainjector, and webhook workloads. That scrape path depends on the PodMonitor selector, the http-metrics endpoint, and all three workload ports remaining aligned at 9402/TCP. Metrics port consistency in this area has needed follow-up work before, including #8141 and the cleanup merged in #8952.

I tested a small CI-only relationship contract against the current chart using the public Beta release iac-guard-v==0.1.0b1. The current render is SATISFIED: all three workloads resolve through http-metrics to 9402/TCP. A one-sided selector change becomes VIOLATED, a missing endpoint port becomes NOT_EVALUATED, and a coordinated valid port-name rename remains SATISFIED.

The proposed check would not change chart defaults or rendered production resources. The contract would use RESEARCH_HYPOTHESIS provenance unless the project later chooses to treat it as repository-owned intent. Would the maintainers be open to a focused PR adding this check to CI?

/kind feature