feat(local): pull sunbeam-proxy from Gitea registry; switch to imagePullPolicy Always

Image is now built and pushed by `sunbeam.py --build` rather than imported
directly into k3s containerd. imagePullPolicy changes from Never to Always
so every rollout restart pulls the freshly pushed image.

overlays/local/kustomization.yaml

@@ -22,12 +22,11 @@ resources:
   - ../../base/vso
 
 images:
-  # Local dev: sunbeam-proxy is built and imported directly into k3s containerd.
-  # imagePullPolicy: Never is set in values-pingora.yaml so k3s never tries to pull.
-  # Production overlay points this at src.DOMAIN_SUFFIX/studio/sunbeam-proxy:latest.
+  # Pulled from our Gitea registry. Built and pushed by: sunbeam.py --build
+  # imagePullPolicy: Always in values-pingora.yaml ensures each rollout pulls fresh.
   - name: sunbeam-proxy
-    newName: sunbeam-proxy
-    newTag: dev
+    newName: src.DOMAIN_SUFFIX/studio/sunbeam-proxy
+    newTag: latest
 
   # amd64-only La Suite images — mirrored to our Gitea registry with a patched
   # OCI index that adds an arm64 alias so Rosetta can run them on the Lima VM.

overlays/local/values-pingora.yaml

@@ -12,7 +12,7 @@ spec:
     spec:
       containers:
         - name: pingora
-          imagePullPolicy: Never
+          imagePullPolicy: Always
           ports:
             # Bind HTTP/HTTPS directly to the Lima VM's host network
             - name: http