fix: replace bitnami/kubectl with EKS Distro image before ECR Public removal (June 10, 2026)

## Problem

Bitnami's container images will be **removed from Amazon ECR Public Gallery on June 10, 2026** ([AWS blog](https://aws.amazon.com/blogs/containers/bitnami-image-removal-from-ecr-public/)). After that date, any pull from `public.ecr.aws/bitnami/` will fail.

The following files in this repo reference bitnami images and need to be updated:

| File | Current image | Impact |
|------|--------------|--------|
| `gitops/addons/charts/keycloak/templates/split-brain-detector.yaml` | `bitnami/kubectl:latest` | Keycloak split-brain CronJob will fail to pull |
| `gitops/addons/default/addons/airflow/values.yaml` | `bitnami/postgresql` (repository) | Airflow PostgreSQL sub-chart |
| `gitops/apps/backend/rabbitmq/base/generated.yaml` | `public.ecr.aws/bitnami/rabbitmq:3.11.1-debian-11-r0` | RabbitMQ demo app |

## Proposed Fix

Replace `bitnami/kubectl:latest` with the official **EKS Distro kubectl image**:

```yaml
# Before
image: bitnami/kubectl:latest

# After
image: public.ecr.aws/eks-distro/kubernetes/kubectl:v1.30.2-eks-1-30-latest
```

For `bitnami/postgresql` in Airflow and `bitnami/rabbitmq`, evaluate whether to pin to Docker Hub (`docker.io/bitnami/...`) or migrate to alternative images.

## Deadline

**June 10, 2026** — pulls from `public.ecr.aws/bitnami/` will start failing.