`atmos helmfile`: `-i` after `--` is parsed as `--identity`, dropping `--profile` from `aws eks update-kubeconfig`

### Describe the Bug

Arguments after `--` should pass through to helmfile verbatim. Since the `--identity` flag was added, `atmos helmfile apply -s -- -i` (helmfile's `--interactive` shorthand) is consumed as `--identity`. This silently switches the `use_eks` kubeconfig step to identity auth, so the `--profile` from `helm_aws_profile_pattern` is omitted from `aws eks update-kubeconfig`. With no `auth.identities` configured, the AWS CLI falls back to the default credential chain and fails with `NoCredentials`.

Regression: 1.214.0 passes `--profile` with the identical command line.

### Expected Behavior

`-- -i` reaches helmfile untouched and `aws eks update-kubeconfig` is called with `--profile `. If identity auth is selected with no usable identity, Atmos should error clearly instead of silently dropping `--profile`.

### Steps to Reproduce

```yaml
components:
helmfile:
use_eks: true
region: us-west-2
helm_aws_profile_pattern: "{stage}-admin"
```

```bash
atmos helmfile apply mycomponent -s dev -- -i
```

### Screenshots

Captured `aws` invocations via a PATH wrapper (1.220.0 darwin/arm64):

```
apply mycomponent -s dev → aws --profile dev-admin eks update-kubeconfig ...
apply mycomponent -s dev -- --interactive → aws --profile dev-admin eks update-kubeconfig ...
apply mycomponent -s dev -- -i → aws eks update-kubeconfig ... (no --profile)
```

On 1.214.0, `apply ... -- -i` passes `--profile`.

```
aws: [ERROR]: An error occurred (NoCredentials): Unable to locate credentials. You can configure credentials by running "aws login".

Error

Error: subcommand exited with code 253
```

### Environment

```
👽 Atmos 1.220.0 on darwin/arm64
```

aws-cli 2.35.0, helmfile v1.5.3

### Additional Context

In `internal/exec/helmfile.go`, `--profile` is only appended when `!useIdentityAuth && helmAwsProfile != ""`; `ResolveAWSAuth` returns `UseIdentityAuth=true` because `info.Identity` is set from the misparsed `-i`. Related but distinct: #2279 (subprocess doesn't receive identity auth env either). Workaround: use `-- --interactive` instead of `-- -i`.