fix(ci): deploy gateway by image digest

[mattmattox]

Summary

• pin the production gateway Helm release to the OCI digest emitted by the same Buildx job
• resolve and record the linux/amd64 child manifest so pod runtime identity is verified correctly
• fail closed on missing/malformed digests and require Deployment, ReplicaSet, and Ready pod identity to agree
• preserve tested tag fallback and verify rollback restores the prior image
• document the gateway-only scope; controller-managed project pods remain tag-based

TaskForge: #22076 (kubetty-102)

Validation

• go test ./... (server)
• go build ./cmd/gateway && go build ./cmd/project
• npm test -- --watch=false (138 passed)
• npm run build
• bash .github/scripts/test-helm-image-ref.sh
• gateway and project helm lint / helm template
• shellcheck .github/scripts/test-helm-image-ref.sh
• 21 cross-cluster kubeconfig security-validation tests
• independent QA: PASS
• mock/placeholder scan: CLEAN

Deployment note

The PR workflow does not publish or deploy. After merge, the main workflow must prove the OCI digest mapping and production ReplicaSet rollout before this task is closed.