feature: pin/preload e2e workload images

[atkrad]

v1 e2e (#37) accepts imagePullPolicy: Always and pulling nginx:latest from the network. That is a common flake source (registry rate limits, transient pull failures) and slows CI on cold runners.

Harden the e2e workload image path after #37:

• Pin a digest (or fixed tag) for the smoke image in the fixture / e2e copy.
• Optionally preload / cache the image into Kind nodes (reuse localkube LoadImage once proposal: load local images into the local cluster #30 exists, or Kind load in CI).
• Prefer stable pulls over :latest + Always for the e2e fixture only (do not change product defaults casually).

Depends on #37. Related: #30 (load local images into the local cluster).

Keeping Always + :latest is simplest and flakier. Mirroring nginx into GHCR under deployah-dev gives more control at the cost of more ops.