probe: unmodified PR #253 workflow, cyberchef + freesailarr in the matrix

Throwaway. The workflow file is byte-identical to PR #253 - the curl -4
Helm step and the shortened matrix of the earlier rounds were diagnostic
crutches and are gone, so this measures what will actually run. Only the
two Chart.yaml versions differ, to pull both charts into the install-test
matrix.

.github/workflows/validate-charts.yml

@@ -288,41 +288,8 @@ jobs:
     steps:
       - name: "Checkout Repository"
         uses: actions/checkout@v7
-      - name: "PROBE egress from the job container (throwaway branch only)"
-        run: |
-          set +e
-          echo "### resolv.conf"; cat /etc/resolv.conf
-          echo "### DNS"
-          for h in get.helm.sh api.github.com raw.githubusercontent.com registry-1.docker.io ghcr.io; do
-            printf '%-28s ' "$h"; getent hosts "$h" || echo "DNS FAILED"
-          done
-          echo "### HTTPS from the JOB container"
-          for u in https://get.helm.sh/helm-v3.18.4-linux-amd64.tar.gz https://api.github.com/ https://raw.githubusercontent.com/ https://registry-1.docker.io/v2/ https://ghcr.io/v2/; do
-            printf '%-62s ' "$u"
-            curl -sS -o /dev/null -m 20 -w 'http=%{http_code} dns=%{time_namelookup}s conn=%{time_connect}s total=%{time_total}s\n' "$u" || echo "CURL FAILED"
-          done
-          echo "### egress of the DOCKER DAEMON (separate network path)"
-          docker pull --quiet alpine:3.20 && echo "docker pull alpine OK" || echo "docker pull alpine FAILED"
-          docker pull --quiet ghcr.io/k3d-io/k3d-proxy:5.9.0 && echo "docker pull ghcr OK" || echo "docker pull ghcr FAILED"
-          echo "### cgroups (the thing that was fixed)"
-          docker info --format 'server={{.ServerVersion}} cgroupDriver={{.CgroupDriver}} cgroupVersion={{.CgroupVersion}} storage={{.Driver}}'
-          docker info 2>&1 | grep -iE "rootless|WARNING" || echo "(no rootless/WARNING lines)"
-          echo "### done - this step never fails on purpose"
-          exit 0
-      # PROBE ONLY - this is NOT a proposed fix and is not in PR #253.
-      # azure/setup-helm downloads from get.helm.sh, which in this cluster
-      # resolves to an IPv6 Azure Front Door address (2603:1061:14:67::1) that
-      # never completes a TCP connect. curl -4 forces IPv4; if this succeeds it
-      # both unblocks the measurement and proves the diagnosis, because every
-      # other host in the probe resolved to IPv4 and answered in under a second.
-      - name: "Install Helm (PROBE: forced IPv4)"
-        run: |
-          curl -4 -sSfL -o /tmp/helm.tgz https://get.helm.sh/helm-v4.3.0-linux-amd64.tar.gz
-          tar -xzf /tmp/helm.tgz -C /tmp
-          mkdir -p "$HOME/.local/bin"
-          mv /tmp/linux-amd64/helm "$HOME/.local/bin/helm"
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-          "$HOME/.local/bin/helm" version
+      - name: "Install Helm"
+        uses: azure/setup-helm@v5
       # freesailarr is the one chart whose install-test needs credentials:
       # without a real Wireguard key gluetun never completes a handshake, and
       # behind its kill switch not a single app container becomes Ready. The key
@@ -365,31 +332,10 @@ jobs:
           : "${FREESAILARR_WG_KEY:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/credential}"
           : "${FREESAILARR_WG_ADDRESSES:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/ip-address}"
           echo "Both VPN values arrived non-empty."
-      - name: "PROBE runner facts (throwaway branch only)"
-        run: |
-          echo "runner=${RUNNER_NAME:-?} os=${RUNNER_OS:-?} arch=${RUNNER_ARCH:-?} nproc=$(nproc)"
-          free -m | head -2 || true
-          df -h / | tail -1 || true
-          docker info --format 'server={{.ServerVersion}} storage={{.Driver}} cgroupDriver={{.CgroupDriver}} cgroupVersion={{.CgroupVersion}} rootless={{.SecurityOptions}} cpus={{.NCPU}} mem={{.MemTotal}}' || echo "docker info FAILED"
-          docker info 2>&1 | grep -iE "rootless|warning" || echo "(no rootless/warning lines)"
-          ls -l /dev/fuse 2>&1 || echo "(no /dev/fuse)"
       - name: "Install k3d"
         run: curl -sSfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG="$K3D_VERSION" bash
       - name: "Create k3d cluster"
-        run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s --no-rollback
-      - name: "PROBE k3s did not come up (throwaway branch only)"
-        if: failure()
-        run: |
-          docker ps -a
-          echo "=== k3s node log ==="
-          docker logs k3d-install-test-server-0 2>&1 | tail -120 || true
-          echo "=== docker info ==="
-          docker info || true
-      - name: "PROBE cluster is usable (throwaway branch only)"
-        run: |
-          kubectl get nodes -o wide
-          kubectl get --raw='/readyz?verbose' | tail -5
-          kubectl -n kube-system get pods
+        run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s
       # Every chart reaching this step is one the exclusion filter let through,
       # so the script's SKIP branch is never taken here - it exists for local
       # runs. The variables below are empty for every chart but the one that