docs(package): document that SourceDateEpoch also rewrites Chart.lock's generated field

Lock.Generated isn't just the tar entry modtime for Chart.lock, it's also
marshaled into the lock file's own YAML content. Made that explicit on both
the SourceDateEpoch field and chart.Chart.StampModTimes so it isn't a
surprise to SDK consumers or future maintainers.

Signed-off-by: Ilya Kiselev <kis-ilya-a@yandex.ru>

pkg/action/package.go

@@ -51,9 +51,12 @@ type Package struct {
 	DependencyUpdate bool
 
 	// SourceDateEpoch, when non-nil, overrides all tar entry modification times
-	// in the produced chart archive. Set by callers that want reproducible builds.
-	// The environment variable SOURCE_DATE_EPOCH is the conventional way to supply
-	// this value from the CLI; reading that variable is the CLI's responsibility.
+	// in the produced chart archive, and also overwrites the "generated"
+	// timestamp in Chart.lock (if present) since that value is both the lock
+	// file's own tar entry modtime and part of its marshaled YAML content.
+	// Set by callers that want reproducible builds. The environment variable
+	// SOURCE_DATE_EPOCH is the conventional way to supply this value from the
+	// CLI; reading that variable is the CLI's responsibility.
 	SourceDateEpoch *time.Time
 
 	RepositoryConfig      string

pkg/chart/v2/chart.go

@@ -110,6 +110,11 @@ func (ch *Chart) Dependencies() []*Chart { return ch.dependencies }
 // because tar headers have second-level granularity and timezone-independent
 // storage. This is used to produce reproducible archives when a build process
 // supplies a fixed timestamp (e.g. via SOURCE_DATE_EPOCH).
+//
+// If Lock is set, its Generated field is also overwritten with t. This is not
+// just a tar header change: Generated is marshaled into Chart.lock's own YAML
+// content, so this stamping is visible to anyone who reads the lock file out
+// of the produced archive.
 func (ch *Chart) StampModTimes(t time.Time) {
 	t = t.UTC().Truncate(time.Second)
 	ch.ModTime = t