fix(ci): publish the Helm chart only after the image

The helm job only depended on release-please, so it ran in parallel with
the image build. Packaging and pushing a chart takes seconds while the
build context, image build, chunked Harbor upload and signing take
minutes, so the chart was reliably published pointing at an appVersion
whose image did not exist yet - and stayed published even when the image
build failed.

Depend on the docker job as well, which also gates the chart on that job
succeeding.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: TheMeinerLP

.github/workflows/release-please.yml

@@ -86,7 +86,12 @@ jobs:
   # needs no chart of its own.
   helm:
     name: Publish the Helm chart
-    needs: release-please
+    # Also on `docker`, not just on the release: the chart is packaged with the
+    # release version as its appVersion, so pushing it before the image exists
+    # publishes a chart that points at a tag nobody can pull yet - and leaves
+    # one published for good if the image build fails. `needs` implies success,
+    # so a skipped or failed docker job skips the chart too.
+    needs: [release-please, docker]
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     permissions: