fix(ci): tighten publish_chart phase against silent half-success

Three issues from a second pass over the new opt-in chart publish:

1. Each gated step had `if: steps.bump.outputs.changed == 'true'`
   without `success()`. In GitHub Actions an explicit `if:` REPLACES
   the default `success()` check, so a failed `git push` (e.g. branch
   moved during the run) would still let the subsequent helm push run
   — leaving the OCI chart pushed but the source-of-truth commit not
   in git. Prepend `success() &&` to every gated step.

2. Version parsing `IFS=. read -r MAJ MIN PATCH` blindly trusted
   `X.Y.Z` shape. A version like `1.5.6-rc1` parsed PATCH as `6-rc1`
   and `$((PATCH+1))` would crash mid-bump after sed had already
   modified files. Validate `OLD_VERSION` matches `^[0-9]+\.[0-9]+\.[0-9]+$`
   before mutating anything, and exit with a clear message pointing
   to BUILD.md step 5 for manual bumps.

3. appVersion parsing assumes double-quoted value (current Chart.yaml
   convention). If a future edit drops the quotes, the sed fallback
   silently captures the entire line and the global `sed -i` would
   mangle every file. Validate `OLD_HASH` matches `^[a-f0-9]{7,40}$`
   before proceeding.

Also drop `inputs.publish_chart == true` for the cleaner
`inputs.publish_chart` (the input is `type: boolean`, so the
comparison was redundant).

Edge cases verified: happy path, same-hash skip, pre-release
suffix rejected, build-meta suffix rejected, non-hex appVersion
rejected, 7-char hash accepted, uppercase hash rejected, double-
digit patch (1.5.99 -> 1.5.100).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: EliShteinman

.github/workflows/airgap-build.yml

@@ -813,7 +813,7 @@ jobs:
     name: 5. Publish Helm chart (opt-in)
     needs: [setup, docker]
     if: >-
-      inputs.publish_chart == true &&
+      inputs.publish_chart &&
       inputs.variant == 'both' &&
       inputs.platforms == 'both' &&
       inputs.tag_override == ''
@@ -838,13 +838,22 @@ jobs:
           OLD_VERSION=$(grep '^version:' "$CHART" | awk '{print $2}')
           OLD_HASH=$(grep '^appVersion:' "$CHART" | sed -E 's/.*"([^"]+)".*/\1/')
 
+          # Defensive: ensure parsing produced sensible values before we sed
+          if [[ ! "$OLD_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Cannot auto-bump: version '$OLD_VERSION' is not plain X.Y.Z (pre-release / build suffix not supported by auto-bump — run BUILD.md step 5 manually)." >&2
+            exit 1
+          fi
+          if [[ ! "$OLD_HASH" =~ ^[a-f0-9]{7,40}$ ]]; then
+            echo "Cannot auto-bump: appVersion '$OLD_HASH' is not a hex commit hash (parse fallback hit — check Chart.yaml format)." >&2
+            exit 1
+          fi
+
           if [ "$OLD_HASH" = "$NEW_HASH" ]; then
             echo "appVersion already $NEW_HASH — nothing to bump" >&2
             echo "changed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          # Auto-bump patch (X.Y.Z -> X.Y.(Z+1))
           IFS=. read -r MAJ MIN PATCH <<<"$OLD_VERSION"
           NEW_VERSION="$MAJ.$MIN.$((PATCH + 1))"
 
@@ -866,8 +875,11 @@ jobs:
             echo "changed=true"
           } >> "$GITHUB_OUTPUT"
 
+      # success() must be repeated in every gated step because an explicit `if`
+      # replaces the default success() check — without it, a failed `git push`
+      # would still let the helm push run, leaving git and OCI inconsistent.
       - name: Commit & push
-        if: steps.bump.outputs.changed == 'true'
+        if: success() && steps.bump.outputs.changed == 'true'
         env:
           NEW_VERSION: ${{ steps.bump.outputs.new_version }}
           NEW_HASH: ${{ steps.bump.outputs.new_hash }}
@@ -880,11 +892,11 @@ jobs:
           git push
 
       - name: Install Helm
-        if: steps.bump.outputs.changed == 'true'
+        if: success() && steps.bump.outputs.changed == 'true'
         uses: azure/setup-helm@v4
 
       - name: Helm registry login
-        if: steps.bump.outputs.changed == 'true'
+        if: success() && steps.bump.outputs.changed == 'true'
         env:
           DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
           DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
@@ -893,7 +905,7 @@ jobs:
             -u "$DOCKERHUB_USERNAME" --password-stdin registry-1.docker.io
 
       - name: Package & push chart
-        if: steps.bump.outputs.changed == 'true'
+        if: success() && steps.bump.outputs.changed == 'true'
         id: chart_push
         env:
           DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}