Make CRD dedup winner deterministic

[tamalsaha]

Problem

crd-only deduplicates CRDs by GroupKind, keeping the first copy it encounters. But which copy is "first" is decided by the order Helm's CRDObjects() enumerates the chart tree — and that order is not stable. It varies with how subcharts happen to be loaded (a directory vs a vendored .tgz, freshly pulled OCI dependencies, Helm version, diamond dependencies).

#4 made the output file ordering deterministic (sorted crdKeys), but it did not change which duplicate wins. So when the same CRD (GroupKind) is shipped by multiple charts with differing content, the generated *-certified-crds chart still flaps between the conflicting copies from run to run — e.g. cert-manager's Certificate/Issuer CRDs, which several subcharts vendor.

Reproduction (parent chart with subchart sub present as both a directory and a .tgz, each shipping a different version of the same CRD):

OLD (master): distinct outputs across 12 runs = 2   # flaky
NEW (fix):    distinct outputs across 12 runs = 1   # deterministic

Fix

Collect every candidate CRD with its source chart path and a content digest, then choose the winner by a total order:

1. group, then kind — stable output file order
2. chart depth — the parent chart wins over its subcharts (preserves the previous "parent takes precedence" intent)
3. chart path, then filename — stable tiebreak among subcharts
4. content digest — final tiebreak for the case where one subchart is present as both a directory and a .tgz (or reached via a diamond dependency) with differing content, so the key (group, kind, path, filename) would otherwise tie and sort.Slice (unstable) would pick arbitrarily

Because candidates are sorted by (group, kind) first, the output slice is already in stable order — the separate post-sort of keys is removed. The redundant second pass over ch.Dependencies() is dropped too, since CRDObjects() already recurses into all subcharts.

A duplicate warning is now emitted only when a dropped copy actually differs in content from the winner, so identical duplicates (the common case) stay quiet while genuine version conflicts remain visible.