feat(helm-mirror): update repository chart dependencies

Current-head verification (supersedes historical evidence below)

The registry documentation route is restored in 47856ba0. docs/registry-authentication.md is byte-identical to the owner-edited root guide, which remains unchanged. All four inbound catalog links now have a source page again. Markdownlint, Vale, front-matter/route checks, rendered Markdown review, whitespace and a no-op current-main rebase pass.

• Required current-head MR CI, including the Docusaurus documentation build, passed. All three generated child pipelines (Helm mirror and both CI lint components) passed; no active or failed jobs remain in the complete generated tree. This tree does not instantiate cluster cleanup jobs.
• Final nine-file scoped diff reviewed; clean source branch fetched and fast-forwarded, current-main rebase is a no-op. The required Bash trace proves component-local dependency and digest regressions executed; the real-Git dependency regression also passes locally.

Current-head DoD is met; ready for deterministic reviewer selection. Historical successful pipelines below are not used as current-head evidence. No required checks are bypassed.

---

Plan

1. Add default-enabled dependency write-back after a successful Helm mirror.
2. Match source/mirror chart dependencies, refresh metadata/lock/vendored archives, and commit from the current remote branch tip with ci.skip.
3. Verify no-op/opt-out/dry-run and branch-race behavior; run complete required MR CI.

Acceptance criteria

• update-dependencies is boolean and defaults to true; disabled and dry-run modes do not invoke repository write-back.
• Matching requires chart name plus source/mirrored repository; dependency aliases and same-named unrelated dependencies are preserved.
• Matching parent charts receive the actual published metadata version and mirrored OCI repository; Helm refreshes Chart.lock and vendored subchart archives.
• Branch/MR/tag destination selection is explicit; work starts at the latest remote branch tip in an isolated worktree.
• No matches and identical dependencies do not commit or push. Unrelated staged files remain untouched. Push uses ci.skip, never force.
• Local Git integration tests cover stale detached checkout, preservation of a newer branch commit, vendoring, source URL/alias matching, same-name exclusion, idempotence, failed Helm refresh, cross-project rejection and concurrent push rejection.
• Python compilation, Markdown, Vale, rendered documentation, final diff and rebase pass.
• Exact-head CI lint passes.
• Complete amended-head MR CI passes: https://gitlab.com/xrow-public/ci-tools/-/pipelines/2984457642.

Notes

Registry-backed Helm refresh is stubbed in the focused Git integration test; Git repositories, commits, push-option negotiation, branch isolation, race rejection and YAML edits are real. Existing component tests keep their external mirror checks and explicitly disable repository write-back; the local integration test owns write-back proof without modifying a shared project.

Normal Helm dependency refresh may resolve other dependencies inside their existing constraints; the guide makes this behavior explicit and recommends exact pins where required. Protected branch write permission is still required for write-back.

Closes #420 (closed).

Final verification

The complete exact-head pipeline passed all 39 root jobs and all 60 component children. The actual Helm mirror child passed all four mirror/pull/discovery jobs; the root Git integration regression passed matching, latest-branch isolation, bundled-chart refresh, ci.skip, idempotence, failure and race checks. The write-back test uses real local Git repositories and stubs only registry-backed Helm refresh, as documented. Fetched, fast-forwarded and rebased without changing the validated SHA; scoped final diff and documentation reviewed. This MR is ready for deterministic review.

Amended layout acceptance

• Component-owned updater is in templates/helm-mirror/bin; both regression files are in its bin/tests.
• Runtime calls use the new component-local path; the catalog archive contains the component tree.
• A generic scripts/tests/component-regressions.ci-test.sh discovers component bin/tests/*.ci-test.sh through the unchanged required catalog Bash job.
• Discovery fails on the old layout; real Git matching/isolation/vendoring/no-op/failure/race checks execute and pass on the new layout, including from an unrelated working directory.
• Shell/Python syntax, whitespace, scoped diff and root CI lint pass; branch rebased onto current main.
• Full amended-head CI succeeds and the exact-head Bash trace proves the moved regression executed before review.

The amended-head pipeline and all 61 downstream pipelines succeeded, including all six cleanup/stop jobs. The required catalog Bash trace proves component-local regression discovery and execution. The final scoped diff and no-op current-main rebase are verified; owner layout feedback is addressed.