[DO NOT MERGE] point kairos-init at the ssh-hardening PR image

Consumes the preview image published by kairos-io/kairos-init#432 so
this PR's ssh-hardening job runs against the unreleased hardening
work. Revert this commit and bump the KAIROS_INIT tag to the release
that lands the hardening before merging.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Dimitris Karakasilis <dimitris@karakasilis.me>

Author: jimmykarily

images/Dockerfile

@@ -1,7 +1,11 @@
 ARG BASE_IMAGE=ubuntu:20.04
 ARG KAIROS_INIT=v0.16.3
 
-FROM quay.io/kairos/kairos-init:${KAIROS_INIT} AS kairos-init
+# TEMP: point at the kairos-init PR preview image so this PR exercises the
+# unreleased ssh-hardening branch (kairos-io/kairos-init#432). Revert to
+# `FROM quay.io/kairos/kairos-init:${KAIROS_INIT}` before merge and bump
+# KAIROS_INIT to the released tag that contains the hardening.
+FROM ghcr.io/kairos-io/kairos-init:pr-432 AS kairos-init
 
 FROM ${BASE_IMAGE} AS base-kairos
 ARG MODEL=generic