ci(cert_manager): decouple helm repository management from idempotency checks

Remove custom changed/failed logic for helm repo add and separate repo update step, improving playbook reliability by relying on helm's built-in idempotency and reducing false positives during dry-run execution

roles/cert_manager/tasks/helm.yml

@@ -5,8 +5,8 @@
     KUBECONFIG: "{{ cert_manager_kubeconfig }}"
     PATH: "/usr/local/bin:/usr/bin:/bin"
   register: _helm_repo_add
-  changed_when: "'already exists' not in _helm_repo_add.stdout"
-  failed_when: _helm_repo_add.rc != 0 and 'already exists' not in _helm_repo_add.stdout
+  changed_when: false
+  failed_when: _helm_repo_add.rc != 0 and 'already exists' not in _helm_repo_add.stderr
 
 - name: Helm | Update chart repositories
   ansible.builtin.command: helm repo update
@@ -25,9 +25,16 @@
   changed_when: false
   failed_when: _cert_manager_crds.rc != 0
 
+- name: Helm | Update repositories
+  ansible.builtin.command: helm repo update
+  environment:
+    KUBECONFIG: "{{ cert_manager_kubeconfig }}"
+    PATH: "/usr/local/bin:/usr/bin:/bin"
+  changed_when: false
+
 - name: Helm | Install or upgrade cert-manager
   ansible.builtin.command: >
-    helm repo update && helm upgrade --install cert-manager jetstack/cert-manager
+    helm upgrade --install cert-manager jetstack/cert-manager
     --namespace {{ cert_manager_namespace }}
     --create-namespace
     {% if cert_manager_chart_version is defined and cert_manager_chart_version | length > 0 %}