Use global.tlsDisable=false instead of duplicating BAO_ADDR

Setting a second BAO_ADDR via extraEnvironmentVars produced two entries
with the same name in the container env list. kubectl itself warns
this 'may be dropped when using apply', and in practice the live
StatefulSet kept only the first (http) value, leaving the pod stuck
NotReady. The chart already exposes global.tlsDisable specifically to
drive BAO_ADDR/health-check scheme - use that instead.

Co-authored-by: Copilot <[email protected]>

values.yaml

@@ -6,6 +6,11 @@
 ## here - see `helm show values openbao/openbao` for the full list.
 
 openbao:
+  # Tells the chart's own helpers (BAO_ADDR, health-check scheme, etc.) that
+  # the server listener speaks TLS - avoids duplicate/conflicting env vars.
+  global:
+    tlsDisable: false
+
   server:
     # Standalone mode: single replica, file storage backend, PVC-backed.
     standalone:
@@ -56,13 +61,6 @@ openbao:
         cpu: 500m
         memory: 512Mi
 
-    # The chart hardcodes BAO_ADDR=http://127.0.0.1:8200 for internal CLI
-    # calls (readiness/liveness probes, etc.). Override it now that the
-    # listener speaks TLS, otherwise the pod never becomes Ready.
-    extraEnvironmentVars:
-      BAO_ADDR: https://127.0.0.1:8200
-      BAO_SKIP_VERIFY: "true"
-
   ui:
     enabled: true
     # NodePort, same pattern as ArgoCD (30080/30443) and Gitea (30300):