Add set -e and safe.directory to updateHelmTag's git clone

Build failed: "Cloning into '.'..." with no further output, then
git config later failing "fatal: not in a git directory" despite the
cloned file being present and editable. Likely cause: this stage just
started running in container('docker-cli') (root — docker:27-cli's
base has no non-root USER) right when it broke, while deleteDir()
just before it runs via the Jenkins agent's own JNLP process (a
different, non-root UID) — git refuses to trust a repo directory
owned by a different UID than the current process, and that refusal
can surface as an unrelated-looking error on a later command rather
than a clear ownership error on the clone itself. Adds
`git config --global --add safe.directory '*'` (safe here — this
workspace is a throwaway, container-local checkout for one build) and
set -e so a genuinely failed clone stops the script immediately
instead of running later commands against partial state.

src/com/homelab/stages/updateHelmTag.groovy

@@ -49,8 +49,36 @@ def run(Map config) {
                     // missing trailing '}'`.
                     def urlParts = config.helm_repo_url.split('://', 2)
                     def authedUrl = "${urlParts[0]}://\${GIT_USER}:\${GIT_PASS}@${urlParts[1]}"
+                    // set -e added after a build showed "Cloning into
+                    // '.'..." with no further output, then a later git
+                    // command failing "not in a git directory" — without
+                    // set -e, a failed clone wouldn't have stopped the
+                    // script, letting later commands run against
+                    // whatever partial state was left behind and fail
+                    // with a confusing, disconnected error instead of
+                    // pointing straight at the clone.
+                    //
+                    // safe.directory added for the same failure: this
+                    // stage started running in container('docker-cli')
+                    // (root, docker:27-cli base has no non-root USER)
+                    // right when it broke, while deleteDir() just before
+                    // it runs via the Jenkins agent's own JNLP process
+                    // (a different, non-root UID) — modern git refuses
+                    // to trust a repo directory owned by a different UID
+                    // than the current process, and that refusal can
+                    // surface as an unrelated-looking "not a git
+                    // directory" on a *later* command instead of a clear
+                    // ownership error on the clone itself. Safe to trust
+                    // unconditionally here: this workspace is a
+                    // throwaway, container-local checkout for one build.
+                    // `git status` right after clone is a cheap
+                    // diagnostic that'll make the actual state obvious
+                    // if something else is still wrong.
                     sh """
+                        set -e
+                        git config --global --add safe.directory '*'
                         git clone ${authedUrl} .
+                        git status
                         yq -i '${config.image_tag_yq_path} = "${env.TAG}"' ${valuesFile}
                         git config user.email 'jenkins-ci@homelab.local'
                         git config user.name 'jenkins-ci'