admission Deployment does not expose --enable-root-queue-protection

[scoot1128]

Chart: volcano (used standalone and via split scheduler/controller-manager/webhook-manager installs)
Version: 1.15.1

Problem

v1.15.1 added the --enable-root-queue-protection flag to vc-webhook-manager (defaults to true, per cmd/webhook-manager/app/options/options.go), which prevents modification of the root queue's capability/deserved/guarantee resource attributes once set. The chart's admission Deployment template (templates/admission.yaml) hardcodes the container args: list and does not template this flag from any .Values.custom.* field, unlike most other webhook-manager/scheduler flags (e.g. admission_feature_gates, scheduler_feature_gates, kube_api_qps) which already follow this pattern.

As a result, chart consumers upgrading to 1.15.x have no supported way to disable this new default-on protection without forking the template.

Request

Expose the flag via a new value, e.g.:

custom:
  admission_root_queue_protection_enable: true  # matches upstream default

rendered as:

{{- if not .Values.custom.admission_root_queue_protection_enable }}
- --enable-root-queue-protection=false
{{- end }}

(or equivalent, following the chart's existing convention for optional boolean flags).

Workaround

None currently short of forking templates/admission.yaml.