Upgrade or install (idempotent) helm

Safe in CI — installs if absent, upgrades if present

helm upgrade --install <release> <chart> -f values.yaml -n <ns>