Downstream K8s manifest-authoring gaps: ActorTemplate volumes, image pinning docs, cluster-scoped SandboxConfig discoverability, WorkerPool spread, valkey conf newline

Gap report from running substrate @ `46adcb80` on k3s v1.36.1 via a downstream helm-native install (vendored `manifests/ate-install`). Filed as one report to avoid issue spam — happy to split any of these out.

1. **ActorTemplate `volumes` rejects standard k8s `configMap` volumes** — only `durableDir` / `externalVolumeTemplate` are accepted. Surprising for anyone porting an existing Pod spec; a docs note (or configMap support) would help.
2. **Mutable image tags rejected** ("changing the image invalidates snapshots") — reasonable, but undocumented; every downstream hits it on first contact. Suggest calling out sha-pinning as a requirement in the authoring docs.
3. **Cluster-scoped `SandboxConfig` is easy to miss** — a WorkerPool with gVisor needs it, but it isn't part of the per-namespace install manifests; our vendoring missed it and the failure mode (actors never scheduling) doesn't point at the missing resource.
4. **WorkerPool has no default `topologySpreadConstraints`** — the scheduler co-located both worker pods on one node; a single-node failure would then take out 100% of actors. A default hostname spread (or a documented values knob) would prevent this class of surprise.
5. **`manifests/ate-install/valkey.yaml`: ConfigMap conf lacks a trailing newline** — the StatefulSet command appends `cluster-announce-*` directives with `>>`, producing a fatal glued line (`protected-mode nocluster-announce-hostname ...`, 'wrong number of arguments') and a full valkey crashloop. Fix is a one-line `echo ""` guard before the append block (we've applied this downstream).
6. **Chart/manifest default `ateomImage: ko://...`** is unresolvable outside a ko build environment — pre-resolved image refs in the published manifests would make raw-manifest installs work out of the box.