test(helm): pin that the migrations job never mounts the billing cert

The componentized chart's suite asserts the backend Deployment stays clear of the
billing wiring, since only the gateway serves billable traffic. The classic chart
has no backend, but it does have a second pod: the migrations Job, which renders
its own env from envVars and extraEnvVars. Nothing today wires the billing
include into it, and nothing stopped a future edit from doing so.

Asserts absence of the env, and that the Job grows no volumes or volumeMounts at
all. Both are notExists rather than notContains because the Job renders neither
key by default, so a notContains would fail on an unknown path instead of
checking the absence it looks like it is checking.

helm/litellm-helm/tests/billing_metrics_tests.yaml

@@ -2,6 +2,7 @@ suite: test billingMetrics wiring on the proxy deployment
 templates:
   - deployment.yaml
   - configmap-litellm.yaml
+  - migrations-job.yaml
 tests:
   - it: is off by default, adding no env, volume, or mount
     template: deployment.yaml
@@ -256,6 +257,25 @@ tests:
             mountPath: /etc/litellm/config.yaml
             subPath: config.yaml
 
+  # Only the proxy serves billable traffic. The migrations Job must never mount
+  # the client certificate, and it renders its own env and volumes, so nothing
+  # stops a future edit from wiring the billing include into it by mistake.
+  - it: does not touch the migrations job when enabled
+    template: migrations-job.yaml
+    set:
+      billingMetrics:
+        enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: LITELLM_BILLING_METRICS_ENDPOINT
+            value: https://telemetry.litellm.ai
+      - notExists:
+          path: spec.template.spec.containers[0].volumeMounts
+      - notExists:
+          path: spec.template.spec.volumes
+
   - it: fails loudly when enabled with an emptied secretName
     template: deployment.yaml
     set: