How should GitOps with Helm be designed for production in Helm?

Store declarative release configuration in Git, use pull-request review, restrict direct cluster changes, and let a reconciler apply approved state.