ci(canary): keep helm jwt secret generation enabled

[TaylorMutch]

Summary

Fix the Release Canary Kubernetes Helm job by keeping the chart's PKI/JWT init hook enabled. TLS remains disabled for the canary, but the gateway pod still mounts the sandbox JWT signing secret generated by that hook.

Related Issue

N/A

Related failed run: https://github.com/NVIDIA/OpenShell/actions/runs/26263108448

Changes

• Remove the --set pkiInitJob.enabled=false override from the Release Canary Helm install.
• Update the test-release-canary skill's local kind reproduction notes to keep the hook enabled when TLS is disabled.

Testing

• git diff --check
• mise run pre-commit passes
  • Skipped at maintainer request for this workflow-only fix.
• Unit tests added/updated
• E2E tests added/updated
  • Not applicable; this updates the release canary workflow itself.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)