[codex] Support native Helm post renderers and custom images

[vigneshrajsb]

What changed

This adds native Helm support for a configurable job image and an optional post-renderer path.

The native Helm job can now:

• run with a custom Helm container image instead of the default image
• append --post-renderer <path> when native Helm config provides one
• validate successfully when a custom image is configured without requiring a service-level Helm version override

Why

Some Helm deployments rely on renderer behavior that was previously only available through a custom CI step image. Native Helm jobs need a way to use the same renderer behavior without depending on a CI-specific step type.

Impact

This keeps the native Helm flow in control of command construction while adding a narrow extension point for renderer-backed deployments. Deployments that do not need a renderer are unchanged.

Validation

• pnpm exec jest src/server/lib/nativeHelm/__tests__/helm.test.ts --runInBand

Notes

The tests use generic image values and generic renderer examples only.