resource/helm_release: don't drop the release from state when the lookup fails

resourceReleaseExists reports false both when a release is genuinely absent
and when the lookup against the cluster failed, telling the two apart only
through the returned diagnostics. Read and Delete acted on the boolean before
appending those diagnostics, so any transient error was silently swallowed.

In Read that means a hiccup while talking to the API server (we hit
"net/http: TLS handshake timeout" against AKS, which the kubernetes provider
surfaced as an error in the same run) removes the release from state. The
following plan turns the refresh into a create, and the create then fails
with "cannot re-use a name that is still in use" because the release was
there the whole time. Delete has the same problem: it returns early and drops
the resource without ever running the uninstall, leaving the release behind
in the cluster.

Check the diagnostics first in both places, which is what Create already
does and what the SDKv2 implementation did before the plugin framework
migration.

Author: bitte-ein-bit

helm/resource_helm_release.go

@@ -1015,15 +1015,21 @@ func (r *HelmRelease) Read(ctx context.Context, req resource.ReadRequest, resp *
 		return
 	}
 
+	// resourceReleaseExists returns false both when the release is genuinely
+	// gone and when the lookup itself failed, so the diagnostics have to be
+	// checked first. Otherwise a transient error talking to the cluster (for
+	// example "net/http: TLS handshake timeout") removes the release from
+	// state, and the next apply plans a create that fails with "cannot re-use
+	// a name that is still in use".
 	exists, diags := resourceReleaseExists(ctx, state.Name.ValueString(), state.Namespace.ValueString(), meta)
-	if !exists {
-		resp.State.RemoveResource(ctx)
-		return
-	}
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
+	if !exists {
+		resp.State.RemoveResource(ctx)
+		return
+	}
 
 	logID := fmt.Sprintf("[resourceReleaseRead: %s]", state.Name.ValueString())
 	tflog.Debug(ctx, fmt.Sprintf("%s Started", logID))
@@ -1251,14 +1257,16 @@ func (r *HelmRelease) Delete(ctx context.Context, req resource.DeleteRequest, re
 	name := state.Name.ValueString()
 	namespace := state.Namespace.ValueString()
 
+	// Same as in Read: a failed lookup also reports the release as missing, so
+	// bail out on the diagnostics before treating it as already uninstalled.
 	exists, diags := resourceReleaseExists(ctx, name, namespace, meta)
-	if !exists {
-		return
-	}
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
+	if !exists {
+		return
+	}
 
 	// Get Helm configuration
 	actionConfig, err := meta.GetHelmConfiguration(ctx, namespace)