ci: harden ArtifactHub release verification

[KeiaiLab-PHIL]

Summary

• make ArtifactHub smoke verify the exact GHCR OCI chart version and ArtifactHub package version
• allow chart-only release tags to pass release.yml without building a new operator image
• make helm-publish rerun-safe when the OCI chart version already exists
• replace a stale nolint directive with the staticcheck-supported ignore form

Verification

• bash -n hack/artifacthub_smoke.sh
• actionlint .github/workflows/release.yml .github/workflows/helm-publish.yml .github/workflows/artifacthub-verify.yml
• TAG=1.12.3 bash hack/artifacthub_smoke.sh
• TAG=1.12.4 bash hack/artifacthub_smoke.sh (expected failure before publish)
• helm lint charts/mongodb-operator
• helm template mongodb-operator charts/mongodb-operator --namespace mongodb-operator-system
• helm package charts/mongodb-operator -d /tmp/mongodb-operator-package-check
• make lint
• make test

Notes

• 1.12.4 remains a chart-only release using appVersion/image v1.12.2.
• ArtifactHub tracks oci://ghcr.io/keiailab/charts/mongodb-operator, not the legacy gh-pages Helm index.