List the cozy-installer chart on Artifact Hub #4760

Problem / motivation

The documented Helm install path is helm upgrade --install cozystack oci://ghcr.io/cozystack/cozystack/cozy-installer --version X.Y.Z. That chart is public on GHCR, but nobody can find it on Artifact Hub: a search for "cozystack" returns no packages and no repositories. CLOMonitor's artifacthub_badge check fails for the same reason. It is the only best-practices check not passing (94.74).

The chart metadata would also show badly once listed. packages/core/installer/Chart.yaml carries only apiVersion, name and a placeholder version, with no description, home, icon, sources or license.

Proposed solution

1. A maintainer signs in to https://artifacthub.io with GitHub and creates the cozystack organization. Next, add the other maintainers to it, then add a Helm repository with the URL oci://ghcr.io/cozystack/cozystack/cozy-installer and note the repository ID that Artifact Hub assigns.
2. A contributor PR then does three things:

   • Fill in packages/core/installer/Chart.yaml: description, home: https://cozystack.io, icon (CNCF artwork), sources, keywords, and the annotations artifacthub.io/license: Apache-2.0 and artifacthub.io/links (documentation, install guide).

   • Add an artifacthub-repo.yml, pushed to ghcr.io/cozystack/cozystack/cozy-installer:artifacthub.io with oras push (media types application/vnd.cncf.artifacthub.config.v1+yaml and application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml). The file carries the repository ID and owners, which earns the Verified Publisher mark. It also needs an ignore entry so that nightly tags are not listed as versions:

     repositoryID: <id from step 1>
     owners:
       - name: <maintainer>
         email: <maintainer email>
     ignore:
       - name: cozy-installer
         version: ^0\.0\.0-nightly

     retention.yaml prunes only versions whose tags are all 0.0.0-nightly.*, so the artifacthub.io tag is not at risk.

   • Link https://artifacthub.io/packages/helm/cozystack/cozy-installer from the README install section. CLOMonitor only needs that URL in the README, so this can be a plain link rather than a badge, in keeping with docs(readme): stop the logo filling the page and thin the badge wall #4222.

3. Optionally, request the Official status that CNCF projects qualify for, through the Artifact Hub repository's issue template.

Scope check

• This affects a single component / package (if it spans many, consider a design proposal)
• I can describe the expected behavior concretely (if not, consider a Discussion first)

Alternatives considered

• An exemption in .clomonitor.yml (exemptions: [{check: artifacthub_badge, reason: ...}]). It suits projects with no installable package, which is the reason Kubernetes uses it. Cozystack does publish a public Helm chart as its documented install path, so an exemption would be hard to justify.
• Listing cozystack-packages too. It is a Flux OCI artifact, not a Helm chart, so Artifact Hub cannot list it as one.

Additional context

• Artifact Hub OCI Helm repositories: https://artifacthub.io/docs/topics/repositories/helm-charts/
• Repository metadata file: https://github.com/artifacthub/hub/blob/master/docs/metadata/artifacthub-repo.yml
• Related CLOMonitor work: fix(footer): use the LF Projects copyright notice on every page website#736 and docs(security): add an OpenSSF Security Insights manifest #4757.
• I can send the Chart.yaml, metadata and README PR once the organization and repository exist.