chore: unblock CI (verify CHART_VERSION, bump grpc past CVE) (#937)

* docs: bump CHART_VERSION on Helm upgrade snippet to 0.9.0

The "safe Helm upgrade path for CRDs" snippet added in #883 hard-coded
CHART_VERSION=0.8.0. The pull-lws-verify-main check runs a sed rewrite
that normalises every CHART_VERSION=X.Y.Z to the current release version
(v0.9.0) and asserts a clean git diff, so any older value fails verify
for anyone rebasing onto this commit.

* chore(deps): bump google.golang.org/grpc from v1.79.3 to v1.82.1

Clears GHSA-hrxh-6v49-42gf (HIGH: xDS RBAC + HTTP/2 vulnerabilities in
gRPC-Go). Trivy's DB started reporting this advisory after the last push
to main, so the Build workflow now fails on any new commit even though
no code has changed. Bump also pulls in oauth2 v0.36.0 and genproto
through go mod tidy.