chore(chart): publish signed 1.12.5 chart

[KeiaiLab-PHIL]

Summary

• bump Helm chart to 1.12.5 while keeping appVersion/image at 1.12.2
• use a fresh chart-only version because Artifact Hub OCI repositories cannot force reindexing an existing version by digest change, leaving 1.12.4 cached as signed=false
• document the signed OCI provenance repair in ArtifactHub chart changes

Validation

• helm lint charts/mongodb-operator
• helm template mongodb-operator charts/mongodb-operator --namespace mongodb-operator-system
• helm package charts/mongodb-operator -d /tmp/mongodb-operator-package-1.12.5
• git diff --check
• TAG=1.12.5 ARTIFACTHUB_SMOKE_ATTEMPTS=1 bash hack/artifacthub_smoke.sh (expected pre-publish failure: GHCR chart 1.12.5 not found)