fix(eks): fix helm commands not running ecr public login (#35161)

### Issue # (if applicable)

Closes #<issue number here>.

### Reason for this change

#35148 and #35141

introduced a regression where the ECR public login doesn't happen anymore.

### Description of changes

Fixed the logic responsible for running the helm commands.

### Describe any new or updated permissions being added




### Description of how you validated changes

I ran one of the integ tests and verified it pulled the image correctly. I did not run all integ tests because it will take ages and they validate the same thing.

```
2025-08-05T23:22:50.758Z
INIT_START Runtime Version: python:3.11.v83 Runtime Version ARN: arn:aws:lambda:us-east-1::runtime:26afe95b80f712a3037463ff3166f54bef5aa010c870d7110cc2ce1e1233a3d5
2025-08-05T23:22:51.049Z
START RequestId: 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d Version: $LATEST
2025-08-05T23:22:51.050Z
{"RequestType": "Create", "ServiceToken": "arn:aws:lambda:us-east-1:101763738007:function:MainStack3-awscdkawseksKu-ProviderframeworkonEvent-YtQLVleHIrAc", "ResponseURL": "...", "StackId": "arn:aws:cloudformation:us-east-1:101763738007:stack/MainStack3/78c14e90-7250-11f0-81f1-12f4a2696929", "RequestId": "1afdaae0-52fd-438e-9ca7-8152efd452ff", "LogicalResourceId": "TestClustercharttestocichartEE30CE0E", "ResourceType": "Custom::AWSCDK-EKS-HelmChart", "ResourceProperties": {"ServiceToken": "arn:aws:lambda:us-east-1:101763738007:function:MainStack3-awscdkawseksKu-ProviderframeworkonEvent-YtQLVleHIrAc", "Repository": "oci://public.ecr.aws/aws-controllers-k8s/s3-chart", "Version": "v0.1.0", "Values": "{\"aws\":{\"region\":\"us-east-1\"}}", "ClusterName": "TestCluster9D2C7838-8025b4a536c843d0a5fcbbe485dea518", "RoleArn": "arn:aws:iam::101763738007:role/MainStack3-TestClusterCreationRoleD7A0855A-UEouULUR9ywj", "Release": "s3-chart", "Chart": "s3-chart", "Namespace": "ack-system", "CreateNamespace": "true"}}
2025-08-05T23:22:51.050Z
[INFO] 2025-08-05T23:22:51.050Z 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d {"RequestType": "Create", "ServiceToken": "arn:aws:lambda:us-east-1:101763738007:function:MainStack3-awscdkawseksKu-ProviderframeworkonEvent-YtQLVleHIrAc", "ResponseURL": "...", "StackId": "arn:aws:cloudformation:us-east-1:101763738007:stack/MainStack3/78c14e90-7250-11f0-81f1-12f4a2696929", "RequestId": "1afdaae0-52fd-438e-9ca7-8152efd452ff", "LogicalResourceId": "TestClustercharttestocichartEE30CE0E", "ResourceType": "Custom::AWSCDK-EKS-HelmChart", "ResourceProperties": {"ServiceToken": "arn:aws:lambda:us-east-1:101763738007:function:MainStack3-awscdkawseksKu-ProviderframeworkonEvent-YtQLVleHIrAc", "Repository": "oci://public.ecr.aws/aws-controllers-k8s/s3-chart", "Version": "v0.1.0", "Values": "{\"aws\":{\"region\":\"us-east-1\"}}", "ClusterName": "TestCluster9D2C7838-8025b4a536c843d0a5fcbbe485dea518", "RoleArn": "arn:aws:iam::101763738007:role/MainStack3-TestClusterCreationRoleD7A0855A-UEouULUR9ywj", "Release": "s3-chart", "Chart": "s3-chart", "Namespace": "ack-system", "CreateNamespace": "true"}}
2025-08-05T23:22:52.415Z
Added new context arn:aws:eks:us-east-1:101763738007:cluster/TestCluster9D2C7838-8025b4a536c843d0a5fcbbe485dea518 to /tmp/kubeconfig
2025-08-05T23:22:52.588Z
[INFO] 2025-08-05T23:22:52.588Z 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d Found AWS public repository, will use default region as deployment
2025-08-05T23:22:52.648Z
[INFO] 2025-08-05T23:22:52.647Z 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d Running login command: ['aws', 'ecr-public', 'get-login-password', '--region', 'us-east-1']
2025-08-05T23:22:52.648Z
[INFO] 2025-08-05T23:22:52.648Z 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d Running registry login command: ['helm', 'registry', 'login', '--username', 'AWS', '--password-stdin', 'public.ecr.aws']
2025-08-05T23:22:54.544Z
[INFO] 2025-08-05T23:22:54.544Z 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d Running helm command: ['helm', 'pull', 'oci://public.ecr.aws/aws-controllers-k8s/s3-chart', '--version', 'v0.1.0', '--untar']
2025-08-05T23:22:54.945Z
[INFO] 2025-08-05T23:22:54.945Z 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d Pulled: public.ecr.aws/aws-controllers-k8s/s3-chart:v0.1.0 Digest: sha256:cdf85524b1196fb6c4eef8df90c78f11450489e988c1792a9b3cd7330b0c72c9
2025-08-05T23:22:54.945Z
[INFO] 2025-08-05T23:22:54.945Z 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d Running command: ['helm', 'upgrade', 's3-chart', '/tmp/tmprl8kft5f/s3-chart', '--install', '--create-namespace', '--repo', 'oci://public.ecr.aws/aws-controllers-k8s/s3-chart', '--values', '/tmp/values.yaml', '--version', 'v0.1.0', '--namespace', 'ack-system', '--kubeconfig', '/tmp/kubeconfig']
2025-08-05T23:22:56.836Z
[INFO] 2025-08-05T23:22:56.836Z 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d Release "s3-chart" does not exist. Installing it now. NAME: s3-chart LAST DEPLOYED: Tue Aug 5 23:22:56 2025 NAMESPACE: ack-system STATUS: deployed REVISION: 1 TEST SUITE: None NOTES: s3-chart has been installed. This chart deploys "public.ecr.aws/aws-controllers-k8s/s3-controller:v0.1.0". Check its status by running: kubectl --namespace ack-system get pods -l "app.kubernetes.io/instance=s3-chart" You are now able to create Amazon Simple Storage Service (S3) resources! The controller is running in "cluster" mode. The controller is configured to manage AWS resources in region: "us-east-1" Visit https://aws-controllers-k8s.github.io/community/reference/ for an API reference of all the resources that can be created using this controller. For more information on the AWS Controllers for Kubernetes (ACK) project, visit: https://aws-controllers-k8s.github.io/community/
2025-08-05T23:22:56.838Z
END RequestId: 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d
2025-08-05T23:22:56.838Z
REPORT RequestId: 562fefdc-2c7f-4a89-9c1f-4801c2acdf8d Duration: 5788.71 ms Billed Duration: 5789 ms Memory Size: 1024 MB Ma
```

### Checklist
- [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: aemada-aws

packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.alb-controller-authapi.js.snapshot/asset.623f9dde2c765e8d16b1f59b011a5eea9e619043f8ced2ed316a7a6f03f5c9d4/apply/__init__.py renamed to packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.alb-controller-authapi.js.snapshot/asset.d671460286b61f85906debbcec5341ea4edad148fbc432b0663593611866728e/apply/__init__.py

@@ -991,7 +991,7 @@
        {
         "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
        },
-       "/03063b33cd0e6181b1deeeb06d2eb78f33ad4f71f39310976d3a81023e3cb72d.json"
+       "/c0f077719413e236d294dd5148cde2a3df9317e0cfea4379ccfa42102445adae.json"
       ]
      ]
     }

packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.alb-controller-authapi.js.snapshot/asset.623f9dde2c765e8d16b1f59b011a5eea9e619043f8ced2ed316a7a6f03f5c9d4/get/__init__.py renamed to packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.alb-controller-authapi.js.snapshot/asset.d671460286b61f85906debbcec5341ea4edad148fbc432b0663593611866728e/get/__init__.py

@@ -7,7 +7,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "623f9dde2c765e8d16b1f59b011a5eea9e619043f8ced2ed316a7a6f03f5c9d4.zip"
+     "S3Key": "d671460286b61f85906debbcec5341ea4edad148fbc432b0663593611866728e.zip"
     },
     "Description": "onEvent handler for EKS kubectl resource provider",
     "Environment": {