Declarative portal assets cannot be reset to platform defaults

## Problem

Portal logo and favicon are always-present singleton resources. Declarative configuration can replace them with image data, but it cannot express returning either asset to the Konnect-provided default.

Current sync behavior distinguishes key presence:

- Omitting assets.logo or assets.favicon leaves the current value unchanged.
- Supplying a value such as !file ./logo.png replaces the asset.
- Explicit null is rejected and does not mean reset.
- An empty assets object contains no scoped asset child, while an empty value for logo or favicon is not a valid image payload.

Consequently, after kongctl applies a custom logo or favicon, there is no declarative manifest that restores the platform default without replacing the asset with another explicitly supplied image.

This is especially visible in sync mode: sync scope can express ignore or update for these update-only singletons, but it has no reset-to-default state.

## Expected behavior

Provide an explicit, documented way to reset a portal logo or favicon to its platform default, assuming the Konnect API supports such an operation. The reset representation should be unambiguous and should not change the existing meaning of omission.

The implementation should preserve these rules:

- Omission remains out of scope and does not modify the asset.
- A supplied image continues to replace the asset.
- Reset is explicit and produces the appropriate Konnect operation.
- Unsupported or ambiguous null/empty values produce actionable validation errors.

## Known workarounds

1. Keep a chosen standard/default image in the declarative configuration and replace the current asset explicitly:

assets:
logo: !file ./assets/default-logo.png
favicon: !file ./assets/default-favicon.ico

This restores a team-controlled default, not necessarily the current Konnect platform default.

2. If the Konnect UI or API available in the target environment provides a reset operation, reset the asset outside kongctl and then omit that asset key from declarative configuration. Omission prevents subsequent sync operations from overwriting the manually reset value.

3. If the goal is only to stop declarative management, omit the asset key. This retains the current custom asset; it does not reset it.

## Existing coverage

- Loader unit tests reject null portal singleton values, including assets.logo and assets.favicon.
- Portal asset E2E coverage verifies that omitted assets are not deleted during sync.
- There is no reset test because reset behavior is not currently supported.

Related to #2008 and #2010.

Start with the loader unit tests for portal singleton values and the portal asset end-to-end sync coverage. Determine whether the Konnect API supports resetting logo and favicon assets, then define an explicit representation that preserves omission and rejects ambiguous null or empty values. Done means reset operations work for both assets and tests cover reset, replacement, omission, and validation.

Written by the indexing model from the issue text.