chore(helm): template Chart.yaml from Chart.yaml.tmpl

[chocobar]

Summary

• Move chart version/appVersion source-of-truth from Chart.yaml to Chart.yaml.tmpl with a __VERSION__ placeholder. Rendered Chart.yaml is now gitignored.
• New scripts/render-charts.sh stamps the version from ${DRONE_TAG} / ${TAG_NAME} (leading v stripped). Without a tag, it stamps a sentinel 0.0.0-source-not-installable so accidental local installs are obviously broken.
• Existing scripts/gen_packages.sh and scripts/repo_sync.sh now delegate to render-charts.sh instead of duplicating the sed.
• .drone.yml helm-lint step renders before any helm command, then re-renders with a synthetic real-looking tag and re-lints to catch template breakage that only surfaces with a non-sentinel version.
• Chart READMEs updated to direct users to the published repo at https://charts.helixml.tech and document the render-charts.sh step for chart development.
• .gitignore: anchored only the helix-runner pattern (/helix-runner) to unshadow charts/helix-runner/. Other unanchored patterns (helix, zed-build, tmp) intentionally left as-is to keep ignoring build artifacts in subdirectories like api/cmd/helix/helix and runner-cmd/helix-runner/helix-runner.

Why

charts/*/Chart.yaml had hardcoded versions that went stale between releases (helix-runner 0.3.9, helix-sandbox 0.2.2, helix-controlplane recently bumped to 2.9.0 while latest release is 2.10.x). Users browsing the repo on GitHub or running helm install ./charts/... from a clone saw stale numbers and got confused about which version was current.

Templating eliminates the drift entirely — there's nothing in git that can go stale, and CI always stamps the canonical version at release time.

The previously-published 0.x chart tarballs (61 files: helix-controlplane 0.1.x-0.3.x, helix-runner 0.1-0.3, helix-sandbox 0.1-0.2) have already been removed from gs://charts.helixml.tech and index.yaml regenerated. The repo at https://charts.helixml.tech now only lists 2.x versions.

Test plan

• bash scripts/render-charts.sh with no tag produces sentinel and prints WARN lines on stderr
• DRONE_TAG=v2.10.0 sh scripts/render-charts.sh produces version: 2.10.0 / appVersion: "2.10.0" (leading v stripped)
• DRONE_TAG=v2.10.0-rc1 sh scripts/render-charts.sh accepts pre-release suffix
• DRONE_TAG=v2.10.0+build.5 sh scripts/render-charts.sh accepts build metadata
• DRONE_TAG=not-a-version sh scripts/render-charts.sh fails fast with semver validation error
• helm dependency build, helm lint, helm template all pass on rendered output for all 3 charts (sentinel and synthetic-tag variants)
• helm package of rendered charts produces correctly-named tarballs (helix-runner-2.10.0.tgz etc.)
• Chart.yaml correctly excluded from git via .gitignore (git check-ignore confirms)
• Chart.yaml.tmpl for all 3 charts visible to git (no longer shadowed by the helix-runner rule)
• CI helm-lint step passes on this PR — including the new synthetic-tag re-lint pass
• Tag a release and verify published tgz has the right version stamped (do on first real release after merge)

🤖 Generated with Claude Code

[chocobar]

Self-review. Substantive issues, in order of severity.

Bugs / regressions

1. .gitignore anchoring is over-scoped — regression risk for build artifacts

The PR anchors all four patterns (/helix-runner, /zed-build, /helix, /tmp) when only /helix-runner was actually needed to unshadow charts/helix-runner/. Concrete impact:

• api/cmd/helix/ is a real source dir. Running go build there produces an api/cmd/helix/helix binary. The old unanchored helix rule ignored it; the new /helix rule does not — it'll now show up in git status and can be accidentally committed.
• runner-cmd/helix-runner/ is similarly a source dir that produces runner-cmd/helix-runner/helix-runner on build.

Fix: revert anchoring on helix, zed-build, tmp. Only anchor /helix-runner (the one this PR actually needs). Leaves the broader cleanup for a separate, scoped PR with verified test against a built tree.

2. helm-lint never runs against a real version

.drone.yml helm-lint step has when: event: [push] — it doesn't run on tag events. So the only render that ever gets helm lint-ed is the sentinel 0.0.0-source-not-installable. A Chart.yaml.tmpl that breaks only with real-version substitution (e.g. unquoted __VERSION__ in a place where 2.10.0-rc1 parses differently from 0.0.0-source-not-installable) won't be caught until gen_packages.sh helm package fails mid-release.

Fix: add a lint step that runs DRONE_TAG=v9.9.9-rendertest sh scripts/render-charts.sh && helm lint charts/... so we exercise the real-version path on every push.

3. Inconsistent invocation: sh vs bash

• .drone.yml and scripts/gen_packages.sh invoke sh scripts/render-charts.sh
• scripts/repo_sync.sh invokes bash scripts/render-charts.sh

Script shebang is #!/bin/sh. Both work, but pick one. Prefer sh (matches shebang and works in the alpine helm image which only has busybox ash).

Doc gaps

4. Local dev workflow undocumented

A contributor cloning the repo and running helm lint charts/helix-controlplane now gets a Chart.yaml file is missing error. The READMEs say "don't install from source" but don't say "to develop on the chart, run bash scripts/render-charts.sh first." CONTRIBUTING.md isn't updated either.

Fix: one-line note in each chart README under a ## Developing on the chart heading: bash scripts/render-charts.sh then helm lint .. Or add a make charts target.

Nits (won't block)

5. Validation regex isn't anchored at the end

grep -qE '^[0-9]+\.[0-9]+\.[0-9]+' matches any string starting with X.Y.Z, including the sentinel. So the validation only catches truly malformed values like not-a-version. Effectively a no-op for the sentinel path. Acceptable — the validation is a guard against shell errors, not user input.

6. PR description claims "anchored unrelated build-binary entries... so they don't shadow same-named subdirectories"

Connected to #1 — the framing oversells the change as a correctness fix. It's actually a behavioral change that may regress build-artifact ignoring elsewhere.