How should chart repositories and OCI registries be designed for production in Helm?

Publish immutable semantic versions, authenticate registry access, sign or verify artifacts where required, and promote tested versions unchanged.