fix(helm): warn instead of failing on a tag with no release asset

[tim-thacker-nullify]

Round-4 review fix for #75 (R4-75-1). A <chart>-v<version> tag whose release does not exist, or whose release has no <chart>-<version>.tgz asset, made recover_from_release die - killing validate on every PR, publish-dry-run, and every release run before it reached the step that creates the missing release. Creating the nullify-k8s-readonly-access-v0.1.0 tag that #79's fallback URL needs would have wedged all Helm CI.

• A missing release, or a release without that asset, is now a ::warning:: and that version is dropped from the tagged cross-check. Nothing was ever published for it, so there is nothing to unpublish; if main carries that chart version the release job publishes it and creates the release with --verify-tag.
• An asset whose release records no digest (uploaded before GitHub recorded them) no longer dies. It is downloaded and verified against the chart re-packaged from the tag, or against the LEGACY_TAGS pin, which is the stronger of the two checks.
• Still hard failures: a digest mismatch, a download that fails on an asset that exists, a gh error that is not "release not found", a tag not on main, and an asset whose contents differ from the tag's tree.

The cross-check list is now built while recovering (tagged-checked.tsv) so the post-build assertion covers exactly the versions the site can serve.

Merge order: this chain (#65 -> #70 -> #75 -> this) has to reach main before the collector chain (#68 -> #72 -> #77). main's legacy workflow rebuilds the Pages site from one chart, so merging the collector chain first unpublishes collector 0.2.0.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[tim-thacker-nullify]

Collapsed into #60 at 0efc700 after passing adversarial review; all of this PR's commits are now in #60.