fix: ensure Claude Code updates on rebuild and allow GITHUB_REPO from secret

Two fixes:
- Move Claude Code npm install below TOOLS_CACHEBUST ARG so it actually
  gets refreshed when the cache-bust value changes
- Make GITHUB_REPO env conditional so an empty Helm value no longer
  overrides the value provided via the Kubernetes secret (envFrom)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chart/templates/deployment.yaml

@@ -88,8 +88,10 @@ spec:
               value: {{ .Values.happy.serverUrl | quote }}
             - name: HAPPY_WEBAPP_URL
               value: {{ .Values.happy.webappUrl | quote }}
+            {{- if .Values.githubRepo }}
             - name: GITHUB_REPO
               value: {{ .Values.githubRepo | quote }}
+            {{- end }}
           envFrom:
             - secretRef:
                 name: {{ include "devcontainer.envSecretName" . }}