Warn on the latest tag

Nobody has claimed this yet.

## Parent

#17

## What to build

A values file pinning an image to `latest` gets a warning, so the practice is visible during review rather than discovered in production.

Warning severity, not error, because this is a style opinion about the file rather than a fact about a registry — and error severity has to keep meaning "this reference is broken". The rule is independent of the existence check, so a nonexistent `latest` produces both markers on the same range; no special-casing for the overlap.

One setting turns it off, defaulting to on, because a team that deliberately uses `latest` in development values should not have to live with permanent yellow for the rest of the feature to be useful.

Only `latest`, hardcoded. A configurable pattern list covering `main`, `dev`, `stable` and similar was deferred in spec #17, to be shaped when there is a second real example rather than guessed at now.

## Acceptance criteria

- [ ] `tag: latest` produces a warning-severity diagnostic
- [ ] It is still checked for existence, and a missing `latest` produces both the warning and an error
- [ ] Other tags produce no warning
- [ ] The setting disables the warning without affecting existence checking
- [ ] The setting defaults to on

## Blocked by

- #19 — Tracer bullet: conventional image references get an error diagnostic

Start with blocked issue #19, the tracer bullet for image-reference diagnostics, then trace how values files are checked for image tags and how settings are defined. Done means `latest` emits a warning by default, missing `latest` emits both warning and error, other tags are unchanged, and the setting disables only the warning.

Written by the indexing model from the issue text.