Unify the kars image list into one KARS_IMAGES source of truth + CI parity test

Follow-up from the kars-upgrade-flow review.

**Problem:** The set of kars images is hand-duplicated ≥4×, each slightly different:
- `cli/src/lib/release.ts` `releaseImagePlan`
- `cli/src/commands/up/images.ts` release list (~81-98), build list (~221-231), customer list (~264-279)
- `.github/workflows/release-public-interim.yml` publish matrix

This drift caused: `kars-runtime-langgraph-ts` referenced by the CLI but **not published** (now added to the matrix in the fix), and `kars-a2a-gateway` in none of the CLI lists (placeholder `karsacr.azurecr.io` default image, `enabled:false`).

**Proposed:** One exported `KARS_IMAGES` (`{ghcrRepo, acrRepo, required, kind: core|runtime|mesh|gateway}`) in `lib/release.ts`; derive every list from it, plus a CI test that asserts `az acr manifest show-tags` parity against GHCR for each `required` image (would have caught langgraph-ts before a customer did).

Severity: P2 (maintainability/supply-chain).

Start in cli/src/lib/release.ts and cli/src/commands/up/images.ts, then compare .github/workflows/release-public-interim.yml. Trace how KARS_IMAGES feeds the CLI lists and publish matrix, then run the CI parity test; done means the lists share one source and every required image has matching ACR and GHCR tags.

Written by the indexing model from the issue text.