fix(helm): keep the kind overlay out of ct's fixture glob

ct treats every `ci/*-values.yaml` as a standalone values set and lints each on
its own. kind-values.yaml is not one — it is an overlay layered on
default-values.yaml, so linting it alone renders the chart with every required
secret empty and trips the validateSecrets guards.

That does not fail the build today: helm lint reports a failed `required` at
INFO and still returns 0 charts failed. But it is noise in the log, and the job
only stays green while helm lint keeps classifying it that way.

Renamed to ci/kind-overlay.yaml, outside the glob, with a comment recording why
the suffix is absent. No secrets duplicated; the install job layers it on
default-values.yaml exactly as before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TknQyteeUDn6xi94sH71Y

Author: waleedlatif1

.github/workflows/helm.yml

@@ -183,7 +183,7 @@ jobs:
           helm install sim helm/sim \
             --namespace sim --create-namespace \
             --values helm/sim/ci/default-values.yaml \
-            --values helm/sim/ci/kind-values.yaml \
+            --values helm/sim/ci/kind-overlay.yaml \
             --wait --timeout 15m
 
       - name: Diagnostics on failure
@@ -262,7 +262,7 @@ jobs:
       # (detect-version in ci.yml), so appVersion legitimately names a release
       # that does not exist yet while that release is still being built. Failing
       # on any mismatch would race that workflow and block the very publish the
-      # bump was for. `helm/sim/ci/kind-values.yaml` documents the same
+      # bump was for. `helm/sim/ci/kind-overlay.yaml` documents the same
       # circularity, and it is why appVersion went unbumped for so long.
       #
       # Compares against the latest GitHub release rather than a hardcoded value

helm/sim/ci/kind-values.yaml helm/sim/ci/kind-overlay.yamlhelm/sim/ci/kind-values.yaml renamed to helm/sim/ci/kind-overlay.yaml

@@ -1,6 +1,12 @@
-# CI-only overlay for the kind install test: shrink resource requests so the
+# CI-only OVERLAY for the kind install test: shrink resource requests so the
 # default configuration schedules on a small CI runner. Layered on top of
-# ci/default-values.yaml. Dummy sizing — never use in a deployment.
+# ci/default-values.yaml, which carries the dummy secrets this file omits.
+# Dummy sizing — never use in a deployment.
+#
+# Deliberately NOT named `*-values.yaml`: that is the glob `ct lint` treats as a
+# standalone values set, and it would render this partial overlay on its own,
+# with every required secret empty. Keep the suffix off unless this file becomes
+# self-sufficient.
 
 # Pin every first-party image to the published :latest rather than letting the
 # tag default to Chart.AppVersion. appVersion names the release the chart ships