[Bug] Helm chart cache key ignores repoURL and can return a chart from another repository

Describe the bug

The native helmchart provider can return a cached chart from a different Helm repository for public (non-auth.secretRef) charts when the chart name, version, and cache key prefix are the same.

pkg/cue/cuex/providers/helm/chart_fetch.go builds the base cache key from the optional cache prefix, source type, chart.source, and chart.version, but does not include chart.repoURL. When no auth.secretRef is configured, no source-bound auth suffix separates the entries. The normal Render path uses a singleton provider, so the cache is shared by successive renders.

Affected area

Helm provider / Helm chart installation.

To Reproduce

1. Start two local HTTP Helm repositories, /repo-a and /repo-b.
2. Make both repositories publish a chart named demo at version 1.0.0, but return different chart contents. For example, the first chart has metadata name first-chart and the second has metadata name second-chart.
3. Render the first chart through the same Helm provider, then update the same component to use the second repository while leaving source: "demo" and version: "1.0.0" unchanged. No explicit cache configuration is needed; the helmchart definition supplies the default appName-componentName prefix. The provider-level equivalent is:

first := ChartSourceParams{
    Source: "demo", RepoURL: serverURL + "/repo-a", Version: "1.0.0",
}
second := ChartSourceParams{
    Source: "demo", RepoURL: serverURL + "/repo-b", Version: "1.0.0",
}

1. The first request fetches /repo-a/index.yaml and its chart.
2. The second request returns the first chart from cache without requesting /repo-b/index.yaml.

The provider-level cache key for both requests is:

repo/demo/1.0.0

Through the helmchart definition, the same key is prefixed with the default appName-componentName value.

Observed with a focused unit reproduction:

second chart = "first-chart", repo-a requests = 2, repo-b requests = 0

Expected behavior

The second request should fetch and return the chart from repo-b, and distinct repository URLs should produce distinct cache entries.

KubeVela Version

master at 5cf3e3a80ade9d156b60e0691f2c198c3de004ee.

Kubernetes information

Not applicable. The reproduction uses the Helm provider's unit-test path and local HTTP servers; no live cluster is required.

Duplicate search

I searched open Issues and PRs for helm cache, chart cache, cache key, cache collision, chart_fetch, providers/helm, and repoURL cache; I did not find a matching Issue or fixing PR.

Additional context

The default immutable chart cache TTL is 24 hours. Setting options.cache.ttl to "0" avoids the stale cache, but disables caching rather than preserving source isolation.