feat: use cluster pod imageID as baseline for digest polling, not registry state

[Atrejoe]

Currently, when Keel registers a poll watcher for a deployment, it appears to query the remote registry to establish the baseline digest. This means if the running pods are on an older digest than what's currently in the registry, Keel considers the cluster "up to date" and will only fire when the registry changes again.
Expected behaviour: Keel should read the actual running pod's imageID (available via the Kubernetes API at .status.containerStatuses[].imageID) as the baseline, and compare that against the current registry digest on each poll. If they differ, an update should be triggered immediately — even if the registry hasn't changed since Keel started watching.
Why this matters:

Keel may be deployed after a registry update has already occurred, leaving the cluster silently behind
A Keel pod restart resets the baseline to the current registry state, masking any drift that existed before the restart
Since Keel's SQLite state is ephemeral by default (no PVC), restarts are a realistic scenario

Proposed change: On watcher registration, prefer .status.containerStatuses[].imageID from the live deployment pods as the comparison baseline, falling back to the registry digest only if the pod has never been scheduled or the imageID is unavailable.