Add Helm Chart.yaml and Chart.lock support

[andrew]

Adds Helm support for Chart.yaml and Chart.lock.

Parses chart identity and direct runtime dependencies while preserving repository values. Exposes the Chart.lock dependency digest on ParseResult without copying it to dependency integrity fields, and generates pkg:helm PURLs.

Closes #70.

[Copilot]

Pull request overview

Adds first-class Helm support to the manifests parser by recognizing Chart.yaml (manifest) and Chart.lock (lockfile), extracting chart identity and direct runtime dependencies, and generating pkg:helm PURLs while keeping Helm repository strings in RegistryURL.

Changes:

• Register new helm ecosystem parsers for Chart.yaml and Chart.lock, parsing chart name/version, dependencies, and lockfile digest.
• Extend ParseResult/core.Result with a file-level Digest field and ensure Chart.lock digest is surfaced without populating dependency integrity.
• Add fixtures + unit tests and document Helm support in the README, including PURL expectations.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
testdata/helm/minimal/Chart.yaml	Minimal Helm chart fixture (no dependencies).
testdata/helm/Chart.yaml	Helm chart fixture covering dependency repositories, aliases, constraints, tags/conditions.
testdata/helm/Chart.lock	Helm lockfile fixture covering resolved versions + top-level digest + generated timestamp.
README.md	Documents Helm support and adds Digest to ParseResult documentation.
manifests.go	Adds Digest to public API and adjusts Helm dependency PURL generation to omit repository qualifier.
manifests_test.go	Adds Helm parsing tests and verifies Helm PURLs + lock digest behavior.
internal/helm/helm.go	Implements Helm Chart.yaml / Chart.lock parsers and registration.
internal/helm/helm_test.go	Unit tests for Helm parsers, including malformed YAML and ignoring generated.
internal/core/types.go	Adds Digest to internal parse result type.
imports.go	Wires Helm parser package into side-effect imports.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[andrew]

Drafted pending git-pkgs/purl#31. The if eco == "helm" branch in Parse should go once git-pkgs/purl handles helm registryURL directly; which shape it takes (namespace per package-url/purl-spec#236, repository_url for https/oci only, or suppressed entirely) is decided there.