bug: CI appVersion points to non-existent image + Helm OCI namespace collision with Docker images

[thepagent]

Problem

Two CI design flaws caused the 0.3.1-beta.1 deployment to fail:

1. appVersion always points to a non-existent image

bump-chart job uses github.sha to set appVersion, but the flow is:

5372be8 (PR merge) → triggers Build → image 5372be8 exists ✅
  └→ bump-chart creates PR to update Chart.yaml
     └→ PR merges → new commit 899c3d7
        └→ Chart.yaml appVersion = 899c3d7
           └→ 899c3d7 only changed charts/ → paths filter skips build → image does not exist ❌

2. Helm chart and Docker image pushed to the same GHCR repo

release.yml:  helm push → ghcr.io/thepagent/agent-broker:0.3.1-beta.1  (Helm chart OCI artifact)
build.yml:    docker push → ghcr.io/thepagent/agent-broker:5372be8      (Docker image)

When K3s pulls :0.3.1-beta.1 it gets a Helm chart artifact instead of a Docker image — no entrypoint, no cmd.

3. Not a Dockerfile issue

The Dockerfile ENTRYPOINT is correct. The problem is pulling the wrong artifact type.

Fix

1. bump-chart should push directly to main with [skip ci] instead of creating a PR, preserving the correct image SHA
2. helm push should use a separate OCI path (e.g. oci://ghcr.io/thepagent/charts) to avoid collision with Docker images