Upgrade CI to Helm 4

[renovate]

Summary

Renovate opened this as a plain azure/setup-helm version bump (v3.22.0 → v4.3.0, release notes), but Helm 4 changes enough that the bump does not stand on its own. This PR carries the follow-up work needed to make it land.

• task helm-unittest fails outright under Helm 4. Helm 4 verifies plugin signatures by default, and a git checkout carries no provenance, so the install aborts with plugin source does not support verification. The flag is probed for rather than passed unconditionally, because Helm 3 has no --verify flag and rejects it as unknown — contributors on either major keep working.
• Two workflows were silently already on Helm 4. operator-ci.yml and test-e2e-lifecycle.yml called azure/setup-helm with no version: input, which defaults to latest; they have been pulling v4.2.4 while the other two claimed a v3 pin. All four are now pinned so the version is stated once and cannot drift.
• The Renovate guard against Helm 4 never fired. The rule is scoped to matchManagers: ["custom.regex"] + helm/helm, but the built-in github-actions manager now extracts the action's version: input itself, as a uses-with dependency named helm — which is how this PR was raised. The same overlap produced duplicate bumps (Update dependency helm to v3.21.4 #6581 and Update dependency helm/helm to v3.21.4 #6582). The dead rule and the redundant regex manager are removed, leaving the built-in manager to track Helm across all four workflows.
• helm-unittest bumped to v1.1.2, whose manifest uses the platformCommand/platformHooks form Helm 4 expects; v1.0.3 uses the legacy command/hooks form.
• Chart prerequisites refreshed — both READMEs claimed Helm 3 only.

Type of change

• Dependency update

Test plan

• Manual testing (described below)

task helm-unittest was run end-to-end against both majors with an isolated HELM_PLUGINS, exercising the plugin install path from scratch each time:

helm	plugin install	suites
v4.2.4	--verify=false appended by the probe	74/74 pass
v3.22.0	flag omitted by the probe	74/74 pass

task helm-docs regenerates the two chart READMEs with no drift beyond the prerequisite line, so the workflow's uncommitted-changes gate stays clean.

Independently verified as unaffected by Helm 4, so the rest of the chart tooling needs no changes:

• ct lint passed under v4.3.0 in this PR's own earlier run.
• helm push still prints Digest: %s (pkg/registry/client.go at v4.3.0), so helm-publish.yml's digest grep — which feeds the Cosign signature — keeps working. helm package, helm registry login/logout and helm show chart are unchanged.
• helm upgrade --install and helm uninstall on both charts already run green on v4.2.4 in Operator CI today, across kind v1.33/v1.34/v1.35.

API Compatibility

• This PR does not break the v1beta1 API.

Changes

File	Change
Taskfile.yml	Probe for --verify; bump helm-unittest to v1.1.2
.github/workflows/helm-charts-test.yml	Helm v4.3.0; drop the now-unused # helm regex marker
.github/workflows/helm-publish.yml	Helm v4.3.0
.github/workflows/operator-ci.yml	Pin Helm v4.3.0 (was implicitly latest)
.github/workflows/test-e2e-lifecycle.yml	Pin Helm v4.3.0 (was implicitly latest)
renovate.json	Remove the dead Helm v4 guard and the redundant regex manager
deploy/charts/*/README.md{,.gotmpl}	Prerequisites now state Helm 3.10+ or Helm 4

Does this introduce a user-facing change?

No. The charts themselves are unchanged; this is CI tooling and a documentation correction.

Special notes for reviewers

ct install is the one step no local check can stand in for — it never ran on the original bump, because the job died at helm-unittest first. chart-testing 3.14.0 shells out a bare --wait, which is still valid in Helm 4 (--wait is now a WaitStrategy with NoOptDefVal=watcher), but Helm 4's default readiness path moved from the legacy poller to the watcher strategy. The case worth watching is ci/imageDiscoveryEnabled-values.yaml, which installs a deliberate replicas: 0 Deployment.

Renovate will stop updating this branch now that it carries non-bot commits, so future Helm bumps arrive as a fresh PR.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.91%. Comparing base (7e52ab9) to head (92a6a1d).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6614      +/-   ##
==========================================
- Coverage   78.92%   78.91%   -0.01%     
==========================================
  Files         782      782              
  Lines       78053    78053              
==========================================
- Hits        61601    61599       -2     
- Misses      16447    16449       +2     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[rdimitrov]

/retest

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.