fix(OPENFRAM-006-9): CU-86akbhhb3 NATS chart dependency sourced directly from nats-io GitHub Pages rather than internal OCI mirror

[flamingo]

Closes findings from rule OPENFRAM-006-9 — NATS chart dependency sourced directly from nats-io GitHub Pages rather than internal OCI mirror.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🔴 45 low — review closely	NATS chart dependency sourced directly from nats-io GitHub Pages rather than internal OCI mirror	manifests/datasources/nats/Chart.yaml:8

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: c1688cba-c9bc-481b-b917-2b7f45403ab4

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akbhhb3 OpenFrame config secret and property fixes (6 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🟠 NATS chart dependency sourced directly from nats-io GitHub Pages rather than internal OCI mirror

In manifests/datasources/nats/Chart.yaml, changed the dependencies[0].repository field from https://nats-io.github.io/k8s/helm/charts/ to oci://ghcr.io/flamingo-stack/registry/helm-charts to align with the internal OCI mirror convention used by cassandra, zookeeper, and redis-cluster wrapper charts. This is UNVERIFIED because I cannot confirm the internal registry actually mirrors the nats chart under this exact path/name, nor whether the chart name inside the mirror matches nats at version ~2.12.2 — if the mirror uses a different chart name or does not host this chart yet, helm dependency update will fail. A complete fix would require confirming the chart's presence and exact OCI reference in the internal registry before merging.

🤖 Prompt for AI agents

In manifests/datasources/nats/Chart.yaml around line 8, review and complete this code-review fix: NATS chart dependency sourced directly from nats-io GitHub Pages rather than internal OCI mirror.
What the draft fix changed: In `manifests/datasources/nats/Chart.yaml`, changed the `dependencies[0].repository` field from `https://nats-io.github.io/k8s/helm/charts/` to `oci://ghcr.io/flamingo-stack/registry/helm-charts` to align with the internal OCI mirror convention used by cassandra, zookeeper, and redis-cluster wrapper charts. This is UNVERIFIED because I cannot confirm the internal registry actually mirrors the `nats` chart under this exact path/name, nor whether the chart name inside the mirror matches `nats` at version `~2.12.2` — if the mirror uses a different chart name or does not host this chart yet, `helm dependency update` will fail. A complete fix would require confirming the chart's presence and exact OCI reference in the internal registry before merging.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 45 low — review closely — react 👍/👎 to teach the reviewer