BDD DSL: Authenticate Helm to an OCI registry

[sbaum1994]

Why

The observability and EKS features repeat secret-aware shell pipelines for helm registry login. The registry is meaningful to the workflow, but the password-stdin plumbing obscures the authentication action and is easy to make unsafe.

Scope

Add a step that authenticates Helm to an explicit OCI registry using the current NGC_API_KEY. Keep the registry visible while hiding only the stable password-stdin mechanics.

Acceptance criteria

• Add the step to the documented DSL catalog.
• Require an explicit OCI registry and preserve ${VAR} interpolation for it.
• Read the current NGC API key without placing its value in Gherkin, command arguments, command logs, or failure messages.
• Preserve command failure status and useful non-secret diagnostics.
• Add focused helper, handler, and secret-hygiene tests.
• Migrate suitable Helm registry login commands in the observability and EKS features.
• Pass affected wiring tests and live feature tests.

Parent: #858