`atmos helmfile`: `-i` after `--` is parsed as `--identity`, dropping `--profile` from `aws eks update-kubeconfig`

[thanhdip]

Describe the Bug

Arguments after -- should pass through to helmfile verbatim. Since the --identity flag was added, atmos helmfile apply <component> -s <stack> -- -i (helmfile's --interactive shorthand) is consumed as --identity. This silently switches the use_eks kubeconfig step to identity auth, so the --profile from helm_aws_profile_pattern is omitted from aws eks update-kubeconfig. With no auth.identities configured, the AWS CLI falls back to the default credential chain and fails with NoCredentials.

Regression: 1.214.0 passes --profile with the identical command line.

Expected Behavior

-- -i reaches helmfile untouched and aws eks update-kubeconfig is called with --profile <helm_aws_profile>. If identity auth is selected with no usable identity, Atmos should error clearly instead of silently dropping --profile.

Steps to Reproduce

components:
  helmfile:
    use_eks: true
    region: us-west-2
    helm_aws_profile_pattern: "{stage}-admin"

atmos helmfile apply mycomponent -s dev -- -i

Screenshots

Captured aws invocations via a PATH wrapper (1.220.0 darwin/arm64):

apply mycomponent -s dev                    → aws --profile dev-admin eks update-kubeconfig ...
apply mycomponent -s dev -- --interactive   → aws --profile dev-admin eks update-kubeconfig ...
apply mycomponent -s dev -- -i              → aws eks update-kubeconfig ...   (no --profile)

On 1.214.0, apply ... -- -i passes --profile.

aws: [ERROR]: An error occurred (NoCredentials): Unable to locate credentials. You can configure credentials by running "aws login".

   Error 

   Error: subcommand exited with code 253

Environment

👽 Atmos 1.220.0 on darwin/arm64

aws-cli 2.35.0, helmfile v1.5.3

Additional Context

In internal/exec/helmfile.go, --profile is only appended when !useIdentityAuth && helmAwsProfile != ""; ResolveAWSAuth returns UseIdentityAuth=true because info.Identity is set from the misparsed -i. Related but distinct: #2279 (subprocess doesn't receive identity auth env either). Workaround: use -- --interactive instead of -- -i.