[FEATURE] Publish Helm charts to GHCR on each release #3686

The release workflow packages every chart with the release version and pushes it to GHCR (OCI) with provenance. Publishing runs only in the upstream repository; forks run a dry run.

Tracks "Publish the charts on each release" in the Helm Charts workstream of the Extensible Install Roadmap.

Current state (0b635b80): .github/workflows/release.yaml publishes images and kubectl-ate binaries; there is no chart job.

Required changes

• Add a chart job, gated on upstream like the images job, that pushes to the chart paths in [FEATURE] Release coordinates for images, bases, charts and binaries #3664.
• Add provenance attestations, in line with Release images and kubectl-ate get build provenance attestations #3199.

Dependencies: #3682, #3684; #3664.

Enforcement: after publishing, the workflow pulls each chart anonymously and installs it on kind.

Parent Issue: #3170