fix(charts): pin upstream chart versions/names to ones that exist in their repos

The first Blueprint Release CI run (commit 8c0f766) failed because four chart wrappers referenced upstream chart versions/names that don't exist in their published repositories:

- platform/flux/chart: name was "flux", repo was OCI; actual is name "flux2" in plain helm repo at https://fluxcd-community.github.io/helm-charts. Pinned to 2.13.0.
- platform/openbao/chart: version 2.1.0 was the binary appVersion, not the chart version. Pinned to 0.16.0 chart (which packages openbao 2.1.0 internally).
- platform/keycloak/chart (Bitnami): chart version 25.0.6 was the appVersion of upstream; Bitnami's chart is at 24.7.1 packaging Keycloak 26.0.x. Pinned to 24.7.1.
- platform/nats-jetstream/chart: name was "nats-jetstream"; the upstream chart is named "nats" (it always was — JetStream is a feature of NATS, not a separate chart). Renamed.

Cilium, cert-manager, crossplane, sealed-secrets, spire wrappers were unaffected; their version pins matched upstream availability.

Containerd permission-denied errors from `helm package` on cilium/cert-manager/crossplane/gitea/sealed-secrets are a separate CI plumbing issue (helm tries to pull OCI base images during package build via containerd, but the GitHub Actions runner blocks containerd socket access). Tracked as a follow-up: switch to `helm package --skip-refresh` or use a runner with containerd permissions.

After this commit lands, the next blueprint-release CI run should green-build at minimum the 4 fixed charts. Successful builds publish bp-{flux,openbao,keycloak,nats-jetstream}:1.0.0 OCI artifacts to ghcr.io/openova-io/.

platform/flux/chart/Chart.yaml

@@ -9,6 +9,6 @@ maintainers:
   - name: OpenOva Catalyst
     email: catalyst@openova.io
 dependencies:
-  - name: flux
-    version: "2.4.0"
-    repository: "oci://ghcr.io/fluxcd-community/charts"
+  - name: flux2
+    version: "2.13.0"
+    repository: https://fluxcd-community.github.io/helm-charts

platform/keycloak/chart/Chart.yaml

@@ -10,5 +10,5 @@ maintainers:
     email: catalyst@openova.io
 dependencies:
   - name: keycloak
-    version: "25.0.6"
+    version: "24.7.1"
     repository: https://charts.bitnami.com/bitnami

platform/nats-jetstream/chart/Chart.yaml

@@ -9,6 +9,6 @@ maintainers:
   - name: OpenOva Catalyst
     email: catalyst@openova.io
 dependencies:
-  - name: nats-jetstream
+  - name: nats
     version: "2.10.22"
     repository: https://nats-io.github.io/k8s/helm/charts

platform/openbao/chart/Chart.yaml

@@ -10,5 +10,5 @@ maintainers:
     email: catalyst@openova.io
 dependencies:
   - name: openbao
-    version: "2.1.0"
+    version: "0.16.0"
     repository: https://openbao.github.io/openbao-helm