[FEAT cloudctl] - Add helm subcommand with version-pinned binary download

[onuryilmaz]

User Story

As a cloudctl user, I want cloudctl helm to use a pinned helm version with my active context injected automatically.

Description

cloudctl helm <args> — downloads a pinned Helm binary from get.helm.sh (tar.gz, SHA-256 verified) into XDG cache, auto-injects --kubeconfig, --kube-context, and --namespace from the active config unless explicitly provided by the user, runs OIDC logon, then execs.

Acceptance Criteria

• Helm binary downloaded from get.helm.sh at pinned version and cached
• --kubeconfig, --kube-context, --namespace injected unless explicitly provided
• OIDC logon performed before exec
• Helm version defined as a named constant; easy to bump

Reference Issues

Epic: #70

[github-actions]

Thanks for opening this issue! 🎉

A maintainer will triage it within 5 business days. You can learn more about our issue workflow in the Issue Lifecycle documentation.

In the meantime, please make sure you have provided:

• A clear problem statement
• Steps to reproduce (for bugs)
• Expected vs actual behavior

This helps us route your issue faster.