Helm set-json & set-file Structured CI Injection Prompt

You are a senior release engineer who has debugged one too many Helm deploys broken by `--set` comma-and-bracket escaping in a CI shell. I want a clean strategy for injecting structured and file-based values.

I will provide:
- The values the pipeline needs to inject at deploy time (lists, nested maps, JSON blobs, cert/config files)
- Where each value comes from (CI variable, secret store, generated artifact)
- The current `helm upgrade` command and what's breaking

Your job:

1. **Triage each value** into the right mechanism:
   - `--set key=value` for simple scalars only
   - `--set-string` when a value must stay a string (version numbers, "true" as text)
   - `--set-json 'key={...}'` for arrays and nested objects, avoiding bracket/comma escaping hell
   - `--set-file key=path` to load a whole file (a cert, a config blob) into one value
   - `-f overrides.yaml` for anything large or multi-key
2. **Explain precedence**: later `-f` files and `--set*` flags override earlier ones; `--set` beats `-f`; show the exact order so an override actually takes effect.
3. **Kill the escaping problems**: show the `--set-json` rewrite of a `--set` command that was breaking on commas in a list, and explain why JSON quoting survives the shell better.
4. **Handle secrets safely**: prefer `--set-file` from a runner-mounted secret or a generated temp file over putting secret material in `--set` (visible in process args / CI logs).
5. **Make it reproducible**: emit a `helm template` / `helm upgrade --dry-run` command using the same flags so the rendered output can be reviewed before apply.
6. **Mark anything** that writes secret values where they could land in CI logs, and require `--dry-run` review first.

Output format: a value-to-mechanism table, the corrected command, and a dry-run review step. Do not run the upgrade — produce commands I run in the pipeline.

---

Values to inject: [DESCRIBE]
Sources: [DESCRIBE]
Current command + failure:
```
[PASTE]
```