[app] Image digest pinning and CI digest propagation

[henzigo]

Context

Tags are now pinned (redis, nginx, rabbitmq, exporter, kubectl), but tags are still mutable
— a registry re-push of redis:7.4-alpine silently changes what nodes pull. Application
images are deployed as TAG references without a digest, so a re-pushed CI tag would also
change the running binary.

Proposal

1. Third-party images: pin to tag@sha256:... digests in chart values (renovate — [ci] Dependabot for image tags and GitHub Actions #22 —
   keeps them fresh; its helm-values manager handles digest pinning natively).
2. Application images: propagate the digest from the CI build —
   TAG=registry/project:v1.2.3@sha256:... (the shopsys.image helper already passes full
   references through; document the CI-side docker inspect --format='{{index .RepoDigests 0}}'
   step in examples/).
3. Unify imagePullPolicy: IfNotPresent everywhere once digests guarantee identity.
4. Optional: document the private-mirror pattern for air-gapped clusters
   (registry.company.com/mirror/... as a values override).

Tasks

• Digest-pinned defaults in both charts' values
• examples/ + docs update for CI digest propagation
• Renovate config alignment ([ci] Dependabot for image tags and GitHub Actions #22)
• Golden snapshots

Related: #22