release(helm): prevent stable OCI chart tag mutation and record immutable digests

Problem

The stable Helm chart tags for helm-nvcf-llm-request-router:1.10.0 and
nvcf-gateway-routes:1.16.0 resolved to different OCI manifest digests on
consecutive validation days.

Recorded on the first pull:

Current repeat pull with Helm 3.15.4:

The chart names and metadata versions remained unchanged. Stable consumers
cannot distinguish a deliberate rebuild from an accidental overwrite when a
version tag is mutable.

Expected behavior

Published stable chart tags are immutable, and the release record exposes the
immutable OCI manifest digest that consumers should verify.

Acceptance criteria

• Identify which publication operation changed each tag and whether the chart
  payload changed.
• Prevent release automation from overwriting an existing stable version tag.
• Record the immutable manifest digest in release output or another
  machine-readable provenance record.
• Add a release regression that fails if a stable tag already resolves to a
  different manifest.
• Document the supported recovery process when an incorrectly published chart
  must be replaced without mutating the existing version.

By submitting this issue, you acknowledge that you are an assigned member of
the NVCF development team and agree to follow the project code of conduct and
contributing guidelines.

Start by tracing the release automation that publishes the two stable Helm OCI chart tags, then reproduce the digest changes with Helm 3.15.4. Identify whether the chart payload changed, add a regression for an existing tag with a different manifest, and verify that release output records the immutable digest and documents recovery without mutation.