build: defer companion repo mutex unlock inside IIFE

Move companionRepoMu.Lock()/Unlock() inside the IIFE so the unlock is
deferred and runs even if helmRepoAdd/helmRepoUpdate panic, while keeping
the lock scoped to repo registration only — the long-running helm
upgrade --install --wait still runs unlocked, preserving parallelism.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Ian-wang-liyang

scripts/camunda-deployer/pkg/deployer/helm.go

@@ -244,8 +244,9 @@ func deployCompanionCharts(ctx context.Context, o types.Options) error {
 func deployCompanionChart(ctx context.Context, cc types.CompanionChart, o types.Options) error {
 	// Ensure the Helm repo is registered when a repo-style chart ref is used.
 	if cc.RepoName != "" && cc.RepoURL != "" {
-		companionRepoMu.Lock()
 		err := func() error {
+			companionRepoMu.Lock()
+			defer companionRepoMu.Unlock()
 			if err := helmRepoAdd(ctx, cc.RepoName, cc.RepoURL); err != nil {
 				return fmt.Errorf("companion chart %q: repo add failed: %w", cc.ReleaseName, err)
 			}
@@ -254,7 +255,6 @@ func deployCompanionChart(ctx context.Context, cc types.CompanionChart, o types.
 			}
 			return nil
 		}()
-		companionRepoMu.Unlock()
 		if err != nil {
 			return err
 		}