Separate Helm and templating checks into a dedicated workflow

## Objective

Extract all Helm chart rendering, linting, and Kubernetes templating validation checks from `.github/workflows/CI.yml` into a dedicated `.github/workflows/helm-checks.yml` workflow.

## Context

`.github/workflows/CI.yml` has grown to nearly 1,000 lines. In addition to core Rust compilation, formatting, clippy, unit tests, and security audits, it executes several Helm-related jobs (`helm-lint`, `helm-template-local`, `kube-linter`, `prometheus-alert-rules-lint`). This mixes concerns, clutters CI logs, and slows down feedback loops for pure Rust code changes.

## Deliverables

- [ ] Create `.github/workflows/helm-checks.yml` that triggers on pull requests and pushes touching `helm/**` or `.github/workflows/helm-checks.yml`.
- [ ] Migrate all helm jobs/actions to `helm-checks.yml`.
- [ ] Keep `CI.yml` focused strictly on the Rust crate lifecycle (check, clippy, tests, coverage, audit, security).
- [ ] Update branch protection rules and documentation where status check names change.

## Acceptance Criteria

- [ ] `CI.yml` is significantly leaner and free of Helm templating logic.
- [ ] Helm template validation runs reliably in its own dedicated workflow when Helm files are modified.
- [ ] CI pipeline execution time for Rust PRs is improved.