fix(helm): publish immutable chart releases safely, maybe

- Create draft releases before uploading chart packages
- Update the chart index before making releases immutable
- Keep Helm releases out of the latest release channel
- Serialize chart publishing to avoid index races
- Run the workflow only when Helm-related files change

release-please-config.json

@@ -8,7 +8,8 @@
       "changelog-path": "CHANGELOG.md",
       "bump-minor-pre-major": true,
       "bump-patch-for-minor-pre-major": true,
-      "draft": false,
+      "draft": true,
+      "force-tag-creation": true,
       "prerelease": false
     },
     "supplemental/helm/beszel-hub": {
@@ -17,7 +18,8 @@
       "changelog-path": "CHANGELOG.md",
       "bump-minor-pre-major": true,
       "bump-patch-for-minor-pre-major": true,
-      "draft": false,
+      "draft": true,
+      "force-tag-creation": true,
       "prerelease": false
     }
   }