fix(eso): chart 0.6.1 - fullnameOverride to keep SA names stable

The ESO subchart was prefixing the ServiceAccount with the parent
release name (qsoft-platform-external-secrets), breaking both
ClusterSecretStore.serviceAccountRef and OpenBao's role binding which
both expect plain 'external-secrets'. Lock the name via
fullnameOverride.

values.yaml

@@ -277,5 +277,21 @@ externalSecrets:
 # (Chart.yaml dependency name = "external-secrets"). CRDs install on
 # first apply. Resource limits conservative — ESO is event-driven
 # and idle most of the time.
+#
+# fullnameOverride locks the SA + Deployment + Service names to plain
+# "external-secrets" (no <release-name>- prefix), so the OpenBao role
+# binding and our ClusterSecretStore.serviceAccountRef can reference
+# a stable name across every cluster.
 external-secrets:
   installCRDs: true
+  fullnameOverride: "external-secrets"
+  serviceAccount:
+    name: external-secrets
+  webhook:
+    fullnameOverride: "external-secrets-webhook"
+    serviceAccount:
+      name: external-secrets-webhook
+  certController:
+    fullnameOverride: "external-secrets-cert-controller"
+    serviceAccount:
+      name: external-secrets-cert-controller