Migrate agent installed-images storage from Valkey to DB and expose in v2 API

Currently the same fact (which images are installed on which agent) is stored twice in Valkey DB 3: (1) an installed_image:{agent_id} JSON written directly by each agent every heartbeat, and (2) per-image {image_id} sets of agent ids rebuilt by the manager on every heartbeat. Consumers are only the legacy GQL image fields (installed / installed_agents) and the manager CLI; the v2 stack has no install-status exposure at all (see BA-7081).

This epic migrates the storage to a DB table (agent_images) and exposes the installation relation in the v2 API as connection fields with some/every/none nested filters, following the Deployment.replicas pattern.

Phases:
1. Expose ImageV2.installedAgents in v2 GQL + REST backed by the current Valkey data (no filter).
2. Add the agent_images table and dual-write from the heartbeat path (Valkey writes kept for rollback safety).
3. Switch reads (legacy GQL, REST v1, CLI) to the DB and add the installedAgents nested filter.
4. Remove the Valkey installed-image storage and compatibility paths.

Problems fixed: duplicated storage with repeated canonical-to-ImageID resolution on every 20s heartbeat, full-DB SCAN cleanup on agent exit that always logs WRONGTYPE errors, stale data with no TTL for dead agents, and inability to filter/sort by install status in v2 search.

JIRA Issue: BA-7160

Start by tracing the heartbeat path and the existing ImageV2 v2 API, then compare the requested connection behavior with the Deployment.replicas pattern and BA-7081. Done means completing the four phases: v2 exposure, agent_images dual writes, DB-backed legacy GQL, REST v1 and CLI reads with nested some/every/none filters, and removal of the Valkey compatibility paths.

Written by the indexing model from the issue text.