Add Parameter Store to bootstrap resolver

probod-bootstrap could only resolve aws:// Secrets Manager refs.
Add awsps:// for SSM Parameter Store (GetParameter with decryption)
and awssm:// as an explicit Secrets Manager prefix. Keep aws:// for
backward compatibility. Values are cached per run per backend.
Update Helm, .env.example, and probod-bootstrap changelog.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

contrib/claude/config.md

@@ -27,7 +27,7 @@ Go struct (pkg/probod/)
   │
   ├─► bootstrap builder.go (env var → struct)
   │     │
-  │     ├─► Resolver (aws:// secret-id refs + plaintext env literals)
+  │     ├─► Resolver (aws:// / awssm:// / awsps:// refs + plaintext env literals)
   │     ├─► GNUmakefile dev-config    (env vars → probod-bootstrap → cfg/dev.yaml)
   │     ├─► e2e/internal/testutil/    (env map → bootstrap.Build, tests)
   │     ├─► contrib/lima/provision.sh  (env vars → probod-bootstrap)