Re-deploys with a reused image tag never roll out the new image

### Problem

When a template is re-deployed with a reused image tag — the standard pull request pattern, where every image is tagged with the PR number — only the first deploy updates the running pods. Subsequent deploys publish a new image under the same tag, `oc apply` succeeds, but pods keep serving the previous image.

### Root cause

With an unchanged tag string, the processed template is byte-identical to what is already on the cluster:

1. `oc apply` detects no spec change, so no new ReplicaSet is created and no rollout happens.
2. `imagePullPolicy: Always` only forces a pull when a pod is created; since no pods are recreated, the fresh image is never pulled.
3. The `oc rollout status` follow-up passes immediately because the existing rollout is already complete.

Observed in bcgov/quickstart-openshift (bcgov/quickstart-openshift#2816), but it affects any consumer that deploys PR environments with per-PR tags — which is the pattern this action is typically used with.

### Proposal

Have the action stamp `Deployment` pod templates with a per-deploy timestamp annotation (`kubectl.kubernetes.io/restartedAt`, the same key `oc rollout restart` writes), forcing a rollout on every deploy. Gate it behind a `force_rollout` input defaulting to true for pull requests (mirroring `lite_mode`), so test/prod deploys — which typically get a new tag per release — keep current behavior unless opted in.

Shipping this as a minor release would fix PR environments for all consumers via their regular Renovate/Dependabot pin bumps, with no workflow changes required.