fix(ci): publish vendored chart under distinct OCI name

The fork's chart was pushing to ghcr.io/<owner>/charts/trigger, which
collides with an existing package in the GovSignals org owned by a
different repo — push was 403'd on the blob HEAD probe.

Rename the published artifact to vendored-upstream-trigger by rewriting
Chart.yaml's name field at package time. CHART_NAME env now drives both
the local filename and the OCI path, and the rename only affects the
published artifact (the on-disk chart still says name: trigger so
upstream contracts and lint/test stay unchanged).

Result: ghcr.io/<owner>/charts/vendored-upstream-trigger:<version>.
Consumers reference it via dependencies.name=vendored-upstream-trigger
(or alias: trigger for backwards-compatible subchart values).

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ConProgramming

.github/workflows/helm-prerelease.yml

@@ -24,7 +24,10 @@ concurrency:
 
 env:
   REGISTRY: ghcr.io
-  CHART_NAME: trigger
+  # Published OCI chart name. Distinct from upstream `trigger` so the
+  # GovSignals fork's vendored chart doesn't collide with the upstream
+  # package under ghcr.io/govsignals/charts/trigger.
+  CHART_NAME: vendored-upstream-trigger
 
 jobs:
   lint-and-test:
@@ -127,9 +130,10 @@ jobs:
           echo "version=$PRERELEASE_VERSION" >> $GITHUB_OUTPUT
           echo "Prerelease version: $PRERELEASE_VERSION"
 
-      - name: Update Chart.yaml with prerelease version
+      - name: Update Chart.yaml with prerelease version and rename chart
         run: |
           sed -i "s/^version:.*/version: ${{ steps.version.outputs.version }}/" ./hosting/k8s/helm/Chart.yaml
+          sed -i "s/^name:.*/name: ${{ env.CHART_NAME }}/" ./hosting/k8s/helm/Chart.yaml
 
       - name: Override appVersion
         if: github.event_name == 'workflow_dispatch' && inputs.app_version != ''
@@ -188,7 +192,7 @@ jobs:
             **Install:**
             ```bash
             helm upgrade --install trigger \
-              oci://ghcr.io/${{ steps.owner.outputs.lc }}/charts/trigger \
+              oci://ghcr.io/${{ steps.owner.outputs.lc }}/charts/${{ env.CHART_NAME }} \
               --version "${{ steps.version.outputs.version }}"
             ```
 

.github/workflows/release-helm.yml

@@ -19,7 +19,10 @@ on:
 
 env:
   REGISTRY: ghcr.io
-  CHART_NAME: trigger
+  # Published OCI chart name. Distinct from upstream `trigger` so the
+  # GovSignals fork's vendored chart doesn't collide with the upstream
+  # package under ghcr.io/govsignals/charts/trigger.
+  CHART_NAME: vendored-upstream-trigger
 
 jobs:
   lint-and-test:
@@ -119,6 +122,10 @@ jobs:
           fi
           echo "✅ Chart.yaml version matches release version."
 
+      - name: Rename chart for vendored-upstream OCI publish
+        run: |
+          sed -i "s/^name:.*/name: ${{ env.CHART_NAME }}/" ./hosting/k8s/helm/Chart.yaml
+
       - name: Package Helm Chart
         run: |
           helm package ./hosting/k8s/helm/ --destination /tmp/