Improve helm inventory

In some cases sylvactl inventory does not give any detail on a reconciling HelmRelease:

❯ sylvactl inventory HelmRelease/sylva-system/kyverno 
IDENTIFIER                       STATUS     REASON        MESSAGE
HelmRelease/sylva-system/kyverno InProgress               HelmRelease generation is 16, but latest observed generation is 15
╰┄╴┬┄┄[Conditions]
   ├┄╴Reconciling                True       Progressing   Running 'upgrade' action with timeout of 10m0s
   ├┄╴Ready                      Unknown    Progressing   Running 'upgrade' action with timeout of 10m0s
   ╰┄╴Released                   False      UpgradeFailed Helm upgrade failed for release kyverno/kyverno with chart kyverno@3.6.3: context deadline exceeded

In inventory, we attempt to fetch the lastest version from status.history:

❯ k get hr kyverno -o yaml | yq .status
conditions:
  - lastTransitionTime: "2026-03-20T09:49:30Z"
    message: Running 'upgrade' action with timeout of 10m0s
    observedGeneration: 16
    reason: Progressing
    status: "True"
    type: Reconciling
  - lastTransitionTime: "2026-03-20T09:49:30Z"
    message: Running 'upgrade' action with timeout of 10m0s
    observedGeneration: 16
    reason: Progressing
    status: Unknown
    type: Ready
  - lastTransitionTime: "2026-03-19T16:36:15Z"
    message: 'Helm upgrade failed for release kyverno/kyverno with chart kyverno@3.6.3: context deadline exceeded'
    observedGeneration: 15
    reason: UpgradeFailed
    status: "False"
    type: Released
helmChart: sylva-system/sylva-system-kyverno
history:
  - appVersion: v1.16.3
    chartName: kyverno
    chartVersion: 3.6.3
    configDigest: sha256:992303c589a7a4ed6cd18bc5f7ec8cc87867afa8e80e64cff74cda86669afda6
    digest: sha256:d096b681b922c0f585ee477871ae82f60765de65e0c23f1d839420486fe87757
    firstDeployed: "2025-11-20T10:31:13Z"
    lastDeployed: "2026-03-20T09:23:01Z"
    name: kyverno
    namespace: kyverno
    status: failed
    version: 21
  - appVersion: v1.16.3
    chartName: kyverno
    chartVersion: 3.6.3
    configDigest: sha256:992303c589a7a4ed6cd18bc5f7ec8cc87867afa8e80e64cff74cda86669afda6
    digest: sha256:3b3cfaf89ea6ea98f3fe89963c03147f389376ebdfa504e4609aff0fe754f781
    firstDeployed: "2025-11-20T10:31:13Z"
    lastDeployed: "2026-03-20T09:12:29Z"
    name: kyverno
    namespace: kyverno
    status: failed
    version: 20

    [...]

  - appVersion: v1.16.3
    chartName: kyverno
    chartVersion: 3.6.3
    configDigest: sha256:98713d570678eef9997b2d66087ccde21d18fce8cde6515a5c8fd95e5fbf3fc3
    digest: sha256:efd2f211e737f75c5c7f836e0c03157afc65de73ad39b511cb029101d167037b
    firstDeployed: "2025-11-20T10:31:13Z"
    lastDeployed: "2026-03-19T13:41:50Z"
    name: kyverno
    namespace: kyverno
    status: failed
    version: 8
  - appVersion: v1.14.5
    chartName: kyverno
    chartVersion: 3.4.6
    configDigest: sha256:b1d9c885e0bb412c2953d1196c35eb2a1924f4c869f6ce863d59c2cc0312bdd6
    digest: sha256:f1d89c917b25f61d17624ec74c46a6a5a21f53fbffe91d8fea2a17b283d55c8a
    firstDeployed: "2025-11-20T10:31:13Z"
    lastDeployed: "2026-02-19T12:29:31Z"
    name: kyverno
    namespace: kyverno
    status: deployed
    version: 7
lastAttemptedConfigDigest: sha256:8513465773672f485da9e74412f932e7c092c13d409c8d232feaf1e7f710140c
lastAttemptedGeneration: 16
lastAttemptedReleaseAction: upgrade
lastAttemptedReleaseActionDuration: 10m11.121636974s
lastAttemptedRevision: 3.6.3
lastHandledForceAt: "2026-03-20T09:22:57Z"
lastHandledReconcileAt: "2026-03-20T09:22:57Z"
observedGeneration: 15
observedPostRenderersDigest: sha256:6543ad59a82d75517342fb0b9721d5d9ade6e73c4a83e0f4afab2f762103f20a
storageNamespace: sylva-system

But when multiple successive upgrades have failed as in above example, helm only preserves the latest installed attempted and installed versions in storage:

❯ k get secret -l name=kyverno
NAME                             TYPE                 DATA   AGE
sh.helm.release.v1.kyverno.v11   helm.sh/release.v1   1      19h
sh.helm.release.v1.kyverno.v22   helm.sh/release.v1   1      92s

When Helmrelease is reconciling / running upgrade, it may has already pruned the secret of the last failed version (21 in above example) and stored the new one.

In order to pick this secret when it exists, the proposed change first attempts to fetch helm secret corresponding to last version stored in history + 1 and dump its content if it exists prior to fall back to the secret of the last version in history as before.