ci: sign Helm charts for ArtifactHub

[KeiaiLab-PHIL]

Summary

• sign OCI Helm chart packages in helm-publish using the configured PGP key so ArtifactHub can report signed=true
• keep duplicate tag/release publishes idempotent, while workflow_dispatch can republish an existing chart version for backfill
• extend ArtifactHub smoke retry window based on observed tracker latency
• update the smoke shell test for strict OCI/version/appVersion/signed validation

Validation

• bash -n hack/artifacthub_smoke.sh hack/artifacthub_smoke_test.sh
• bash hack/artifacthub_smoke_test.sh
• actionlint .github/workflows/helm-publish.yml .github/workflows/artifacthub-verify.yml
• git diff --check
• TAG=1.12.4 ARTIFACTHUB_SMOKE_ATTEMPTS=1 bash hack/artifacthub_smoke.sh (expected current live failure: ArtifactHub signed=false before republish)