fix(helm): document image requirement for DNS bypass

Author: waleedlatif1

apps/docs/content/docs/platform/enterprise/verified-domains.mdx

@@ -90,14 +90,18 @@ For a deployment where the operator trusts every organization owner and admin to
 SSO_SKIP_DOMAIN_VERIFICATION=true
 ```
 
-For Helm deployments, set it in your values file:
+For Helm deployments, use an application image built from a revision that includes this setting. Upgrading the chart alone does not make an older application image support the variable. Override `app.image.tag` with a compatible released image or a build you publish yourself; set `app.image.repository` as well for a custom repository:
 
 ```yaml
 app:
+  image:
+    tag: "<image-tag-with-domain-verification-bypass>"
   env:
     SSO_SKIP_DOMAIN_VERIFICATION: "true"
 ```
 
+If `app.image.digest` is set, replace it with a compatible image digest instead — it takes precedence over the tag.
+
 Add the domain under **Domains**, then click **Verify**. No TXT record or DNS access is needed. The domain is recorded as verified for SSO account linking and SCIM provisioning, and another organization still cannot claim the same domain. Existing pending domains can be verified the same way.
 
 <Callout type="warn">

helm/sim/values.yaml

@@ -255,6 +255,7 @@ app:
     SSO_ENABLED: ""                                       # Enable SSO authentication ("true" to enable)
     NEXT_PUBLIC_SSO_ENABLED: ""                           # Show SSO login button in UI ("true" to enable)
     # Self-hosted only: trust every organization owner/admin to verify domains without DNS proof.
+    # Requires a compatible app image; see https://docs.sim.ai/platform/enterprise/verified-domains#skip-dns-verification
     SSO_SKIP_DOMAIN_VERIFICATION: ""                      # Opt in with "true"; unset/"false" requires DNS
     # SSO_TRUSTED_PROVIDER_IDS: comma-separated SSO provider IDs to trust for automatic account linking when a
     # user signs in via SSO and an account with the same email already exists. Only needed for IdPs that do NOT