ci(canary): add kind-based helm chart smoke test to Release Canary

[TaylorMutch]

Summary

Adds a kubernetes job to the Release Canary workflow that smoke-tests the published Helm chart in kind. The job installs oci://ghcr.io/nvidia/openshell/helm-chart --version 0.0.0-dev, waits for the gateway pod, port-forwards the service, registers the gateway with the released CLI, and runs openshell status.

The release canary testing skill was split into stacked PR #1440.

Related Issue

N/A - no tracking issue. Originated from a request to extend the existing macOS, Ubuntu, and Fedora canaries with Helm chart coverage.

Changes

• Adds a Kubernetes Helm (kind) Release Canary job.
• Provisions kind with helm/kind-action@v1 and installs the published dev Helm chart from GHCR.
• Disables TLS and the PKI init job for the canary install so the released CLI can register the loopback port-forwarded gateway.
• Adds failure diagnostics for Helm status, rendered manifests, Kubernetes resources, pod logs, port-forward logs, gateway list, and CLI version.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

The canary itself runs after the next successful Release Dev workflow once this merges. Manual testing guidance is now split into stacked PR #1440.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable) - N/A, workflow-only change.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.