feat(local): pull sunbeam-proxy from Gitea registry; switch to imagePullPolicy Always

Image is now built and pushed by `sunbeam.py --build` rather than imported
directly into k3s containerd. imagePullPolicy changes from Never to Always
so every rollout restart pulls the freshly pushed image.

overlays/local/values-pingora.yaml

@@ -12,7 +12,7 @@ spec:
     spec:
       containers:
         - name: pingora
-          imagePullPolicy: Never
+          imagePullPolicy: Always
           ports:
             # Bind HTTP/HTTPS directly to the Lima VM's host network
             - name: http