fix: clean up temp dirs and close fd leaks in Helm, Kustomize, Cuelang

[kaizeenn]

Summary

Fixes #1509.

Three input compilers created temp directories with tempfile.mkdtemp() and never cleaned them up. Two tempfile.mkstemp() calls discarded the returned file descriptor (_) without closing it. On large or long-running compilation jobs this causes disk-space exhaustion and file-descriptor leaks.

Changes

kapitan/inputs/helm.py

• compile_file: replace mkdtemp() with tempfile.TemporaryDirectory() context manager — rendered-chart dir is now always deleted on exit, even if an exception is raised.
• render_chart: close the mkstemp() fd immediately with os.close(fd), then os.unlink() the temp file after its contents are read.
• write_helm_values_file: close the mkstemp() fd immediately with os.close(fd) before opening the file for writing.

kapitan/inputs/kustomize.py

• compile_file: replace two separate mkdtemp() calls with a single with tempfile.TemporaryDirectory() as temp_dir, tempfile.TemporaryDirectory() as output_dir: block; consolidate the previously split try/except blocks into one, re-raising KustomizeTemplateError directly so it is not double-wrapped.

kapitan/inputs/cuelang.py

• compile_file: replace mkdtemp() with tempfile.TemporaryDirectory() context manager.

Testing

All pre-existing test failures (helm/kustomize/cuelang suites require helm/kustomize/cue binaries not present in CI) are identical before and after this change — no regressions introduced.

[Moep90]

The mkdtemp → TemporaryDirectory() conversions and both fd closes look correct, and the kustomize except KustomizeTemplateError: raise ahead of the generic handler nicely avoids the double-wrap. One inline nit on exception-safety below; non-blocking.

Two related leaks I found while reviewing, both pre-existing and out of scope here, were opened as separate PRs rather than expanding this one:

• #1555 write_helm_values_file()'s temp file is never unlinked by either caller. The fd half is covered here; the file lifecycle isn't. Complementary to this PR, it does touch compile_file, so expect a small conflict with whichever of us merges second.
• #1554 unrelated to #1509: cuelang.py raises KustomizeTemplateError (copy-paste) when CuelangTemplateError already exists in kapitan/errors.py.

Nice cleanup overall.

[Moep90]

os.unlink here isn't exception-safe if helm_cli or f.read() above raises; this line is skipped and the temp file leaks (the same bug class this PR targets). Wrap in try/finally, or let a context manager delete on exit:

with tempfile.NamedTemporaryFile(suffix=".helm_output.yml", mode="w+") as f:
    error_message = helm_cli(helm_path, args, stdout=f)
    f.seek(0)
    return (f.read(), error_message)

Low real-world risk since helm_cli returns the error rather than raising non-blocking.

[ramaro]

@kaizeenn thanks for sending this in. However this approach seems to repeat the same formula in the mentioned input types. Perhaps we can abstract this in the base class or have common generic functions to avoid duplication?