fix: use $(HELM) instead of bare helm in lint-helm target (#2758)

The lint-helm target depends on $(HELM) but invoked helm directly,
which could pick up an unpinned system Helm or fail if Helm isn't
on PATH. Use $(HELM) consistently, matching other targets.

Co-authored-by: Claude <noreply@anthropic.com>