chore: switch helm to aqua backend and bump dogfood mise (#25521)

mise's aqua plugin now templates `{{.Version}}` with the leading `v`, so
the official `get.helm.sh` URLs resolve without the hand-rolled `http:`
workaround that was added when the version-prefix templating was broken.

Drops the templated URL block (and its explanatory comment) in favor of
plain `helm = "3.21.0"`. The regenerated lockfile picks up windows-amd64
(which the old workaround intentionally omitted) and replaces the
locally-computed blake3 checksum with the upstream sha256 sums.

Follow-up to #25520, which bumped the pinned version to 3.21.

---------

Signed-off-by: Thomas Kosiewski <tk@coder.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

mise.toml

@@ -29,6 +29,7 @@ protoc-gen-go = "1.30.0"
 "aqua:ahmetb/kubectx/kubens" = "0.9.4"
 cosign = "2.4.3"
 golangci-lint = "1.64.8"
+helm = "3.21.0"
 kubectx = "0.9.4"
 syft = "1.20.0"
 terraform = "1.15.2"
@@ -52,17 +53,6 @@ lazygit = "0.61.1"
 # module's `command -v devcontainer` short-circuit fires
 "npm:@devcontainers/cli" = "0.87.0"
 
-# helm publishes binaries at get.helm.sh, not on GitHub. Mise's aqua
-# plugin templates the URL without the `v` prefix (404), and the
-# github backend can't find the binary (helm only publishes signatures
-# on GitHub). The http backend with a templated URL covers
-# linux/macos cleanly. Windows is omitted (different extension);
-# the dogfood image is linux/amd64-only and nobody on the team runs
-# helm via mise on Windows.
-[tools."http:helm"]
-version = "3.21.0"
-url = 'https://get.helm.sh/helm-v{{version}}-{{os(macos="darwin")}}-{{arch(x64="amd64")}}.tar.gz'
-
 # sqlc (coder fork) bundles sqlite via cgo, so the `go install` build
 # needs CGO_ENABLED=1. Scope it with `install_env` so it only applies
 # during install. A top-level `[env]` would re-export CGO_ENABLED=1