Releasy: make Helm package reproducible

`helm package` produces a non-reproducible tarball. The archive entries' timestamps are _always_ set to the current timestamp, aka the `helm package` invocation timestamp.

There is sadly no way to pass tar or gzip options to `helm package`.

For Polaris releases, we need a _signed_ Helm package, producing a `.prov` file, which contains more information than "just" the cryptographic signature ([example contents here](https://github.com/snazy/helm-gpg/actions/runs/19240703985/job/55002364031#step:7:8)). Having said that, it's not sufficient to "just" replace `helm package` with a manual `tar`+`gzip`+`gpg` command chain.

It seems a solution is coming ... https://github.com/helm/helm/pull/31323 got merged on Oct 29, 2025.

Start by locating the Releasy configuration or release entry point that invokes `helm package`, then compare its needs with Helm PR #31323. Verify that the generated signed package is reproducible and includes the expected `.prov` metadata.

Written by the indexing model from the issue text.