fix(helm-mirror): compare archives without diffutils

Closes #453 (closed).

Cause and fix

The tools image provides coreutils but not diffutils. The old cmp -s condition treated a missing comparison command as changed content and unnecessarily invoked Helm dependency I/O and Git write-back. Compare archives with the existing sha256sum command instead; standalone checksum assignments under strict mode propagate read failures before any commit or push. No package, component input, authentication precedence or write-back permission changes.

Plan

1. Reproduce missing-cmp behavior and checksum failures.
2. Compare existing and mirrored archive bytes, preserving private checkout and branch-race guards.
3. Verify exact-source component/full CI and final DoD before guarded human review.

Acceptance criteria

• Unchanged archives need neither cmp, dependency I/O nor a commit-helper call/push.
• Changed bytes at an unchanged name/version refresh the vendored archive; the next run is a no-op.
• Either checksum failure returns nonzero without committing or pushing.
• Private checkout, unrelated staged files, same-project MR selection and concurrent-push guards remain covered.
• Required exact-source CI and actual JUnit ingestion pass.

Current-source evidence

The owner-rebased source 4e90826ee2300d0116f21991c2bc83b4ec7db0aa passes pipeline 3008533609, all 62 connected pipelines and all required bridges. Across the complete tree, 220 jobs succeed and three unchanged optional fixture jobs fail; no required job fails, skips or remains unfinished.

The Helm mirror component pipeline passes its real mirror/pull tests and all nine JUnit cases, with zero failures, errors or skips. Documentation and browser checks pass. All six cleanup/stop jobs succeed; Helm/ZAP traces confirm release and namespace removal, while Argo CD traces confirm application deletion.

The complete two-file diff is reviewed and limited to archive comparison and its regression. Main/source were freshly fetched; current-main rebase is a no-op and whitespace checks pass. The owner rebase is preserved without a source rewrite, and no new CI run was created for this verification.

Definition of Done

• Acceptance criteria met; no remaining implementation work.
• Full diff, scope and current-main rebase reviewed.
• Last exact-source pipeline and complete required CI succeed.
• All MR notes and discussion pages inspected; no unresolved implementation feedback.
• No user-facing input or documentation change is needed for this internal fix.

Ready for the guarded human-review path. GitLab Duo service-account verification did not provide automated review evidence and does not replace human review. No approval or merge is claimed.