Pin kars images by digest (not :latest / version tag) for reproducible, signature-verified deploys

Follow-up from the kars-upgrade-flow review (commit on fix/kars-upgrade-flow).

**Problem:** The Helm chart + agentmesh manifest reference `:latest` (the upgrade path now pins `:` tags, which fixed rollback). Tags are still mutable; cosign/Sigstore signatures are over **digests**, so pinning a tag never asserts *which signed digest* is trusted. A retag can swap running bits under a 'verified' banner.

**Proposed:** Resolve the digest at `az acr import` time (`az acr manifest show`/import output) and set `image.repository@sha256:...` in the chart. Makes `helm upgrade` self-sufficient (no rolling-restart needed to refresh), rollback trivially correct, and cosign verification meaningful.

**Note:** supply-chain posture change + release-pipeline contract change — needs security-architecture sign-off.

Severity: P0 (architecture), deferred from the immediate upgrade-flow fix.

Start with the Helm chart, agentmesh manifest, and release flow around az acr import and az acr manifest show. Confirm how the imported digest is obtained and how chart image references and cosign verification should use it; done means deploys and rollbacks use immutable sha256 references and the security architecture approves the pipeline contract.

Written by the indexing model from the issue text.