Add Parameter Store to bootstrap resolver

probod-bootstrap could only resolve aws:// Secrets Manager refs.
Add awsps:// for SSM Parameter Store (GetParameter with decryption)
and awssm:// as an explicit Secrets Manager prefix. Keep aws:// for
backward compatibility. Values are cached per run per backend.
Update Helm, .env.example, and probod-bootstrap changelog.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

entrypoint.sh

@@ -4,18 +4,19 @@ set -e
 # Configuration file path
 CONFIG_FILE="${CONFIG_FILE:-/etc/probod/config.yml}"
 
-# If bootstrap env vars are set, always (re)generate the config from them.
-# This includes literal values and aws:// Secrets Manager references.
-# This ensures that updated env vars take effect even when a stale config
-# file exists on a persistent volume.  When no env vars are present, fall
-# back to an existing config file (e.g., mounted from a ConfigMap).
+# When PROBOD_ENCRYPTION_KEY is set, always (re)generate the config from env vars.
+# This includes literal values and aws:// / awssm:// / awsps:// AWS references.
+# probod-bootstrap reads every PROBOD_* var; the entrypoint only checks this one
+# to decide whether to run it, including when a stale config file exists on a
+# persistent volume. When it is unset, fall back to an existing config file
+# (e.g., mounted from a ConfigMap).
 if [ -n "$PROBOD_ENCRYPTION_KEY" ]; then
   echo "Generating configuration file from environment variables at: $CONFIG_FILE"
   probod-bootstrap -output "$CONFIG_FILE"
 elif [ -f "$CONFIG_FILE" ]; then
   echo "Using existing configuration file at: $CONFIG_FILE"
 else
-  echo "Error: no bootstrap env vars set and no config file found at $CONFIG_FILE" >&2
+  echo "Error: PROBOD_ENCRYPTION_KEY is unset and no config file found at $CONFIG_FILE" >&2
   exit 1
 fi