[rg3122]

Summary

Fixes Helm OCI chart extraction when the provenance file appears before the chart content layer.

When spec.layerSelector is not configured, the controller now checks whether the first layer is a Helm provenance layer. If it is, the controller selects the Helm chart content layer when available. Other OCI artifacts and existing chart-first artifacts retain their current behavior, and an explicit layer selector continues to take precedence.

• Adds a regression test for provenance-first layer ordering.
• Adds a regression test confirming chart-first layer ordering remains unchanged.
• Limits the behavior change to the default layer-selection path.

Fixes #2198.

Testing

• Added unit tests using in-memory OCI image layers.
• Verified the implementation and regression tests are saved in the fork.
• The Go test suite has not been run in this environment because repository cloning and dependency downloads were unavailable.
• CI should run the controller tests before merging.