feat(machine-a-tron): Add Helm chart for nico-machine-a-tron

[akorobkov-nvda]

Is this a new feature, an enhancement, or a change to existing functionality?

Enhancement

How would you describe the priority of this feature request

Medium

Please provide a clear description of problem this feature solves

Currently there is no Helm chart for deploying nico-machine-a-tron, making it difficult to:

1. Deploy machine-a-tron consistently across environments
2. Integrate with the NICo umbrella Helm chart
3. Scale to large test environments with hundreds of simulated BMC endpoints
4. Provide dedicated IP addresses for each simulated BMC that NICo site-explorer can connect to

Real-world example: Testing a deployment with 7 racks × 71 BMC interfaces (497 total) requires a scalable way to expose each mock BMC with its own IP address

Feature Description

When deployed via Helm chart, nico-machine-a-tron shall create K8s ServiceCIDR and ClusterIP service resources to provide dedicated IP addresses for each simulated BMC endpoint, enabling the NICo site-explorer to connect to individual mock BMCs.

Key capabilities:

1. ServiceCIDR resource - Reserves an IP range within the cluster's service CIDR (K8s 1.29+)
2. ClusterIP services - One service per simulated BMC with explicit clusterIP assignment
3. Multi-pod support - Multiple machine-a-tron pods, each handling a CIDR slice
4. Host header routing - machine-a-tron crate uses Host header to route to correct mock BMC

Describe your ideal solution

Site-Explorer -> ClusterIP Service (10.100.x.x:443) -> machine-a-tron pod reads Host header and routes request to a specific BMC-mock server

Crate Changes Required

The nico-machine-a-tron crate needs to use the Host header for BMC routing to determine which mock BMC should handle each request. See #3190

Describe any alternatives you have considered

1. MetalLB + Nginx reverse proxy - Use MetalLB to allocate external LoadBalancer IPs and Nginx to proxy requests with Forwarded header for BMC routing. Adds external dependencies (MetalLB installation, BGP/L2 configuration for large deployments) and additional proxy layer overhead.
2. Ingress with SNI routing - Complex TLS configuration, overkill for internal testing

Additional context

Requirements

• Kubernetes 1.29+ (for ServiceCIDR API)
• Cluster service CIDR must accommodate the reserved range

Modules Affected

• helm/charts/nico-machine-a-tron/ - New Helm chart
• helm/Chart.yaml - Add as subchart dependency
• crates/machine-a-tron/ - Host header routing (separate issue)

Code of Conduct

• I agree to follow NVIDIA Infra Controller's Code of Conduct
• I have searched the open feature requests and have found no duplicates for this feature request