Feature/image volume support

[efiguti]

Summary

Implements #849 — adds opt-in support for tracking and updating
OCI image volume sources
(spec.volumes[].image.reference, Kubernetes 1.31+ with the
ImageVolume feature gate).

• New annotation keel.sh/imageVolumes: "true" — mirrors the existing
  keel.sh/initContainers annotation (off by default, set per-resource).
• Volume names are filtered with the existing
  keel.sh/monitorContainers regex, so one annotation governs all image
  references on the resource (containers + init containers + image
  volumes).
• Supported on Deployments, StatefulSets, DaemonSets and CronJobs via
  the existing GenericResource abstraction.

Example

metadata:
  annotations:
    keel.sh/policy: minor
    keel.sh/imageVolumes: "true"
spec:
  template:
    spec:
      containers:
        - name: app
          image: karolisr/webhook-demo:0.0.8
          volumeMounts:
            - { name: oci-config, mountPath: /etc/config }
      volumes:
        - name: oci-config
          image:
            reference: karolisr/webhook-demo:0.0.8
            pullPolicy: IfNotPresent

Files changed

• types/types.go — new KeelImageVolumeAnnotation constant
• internal/k8s/{resource,converter}.go — VolumeFilter type plus
  Volumes(), GetImageVolumeReferences(), UpdateImageVolume() on
  GenericResource, wired through all four supported kinds
• provider/kubernetes/kubernetes.go — getImageVolumeTrackingFromMeta
  • GetMonitorVolumesFromMeta; TrackedImages() and
    updateDeployments() include image-volume references when the
    annotation is set
• provider/kubernetes/updates.go — new loop in checkForUpdate that
  parses each image volume reference, applies the policy, and rewrites
  it in place
• ARCHITECTURE.md + readme.md — documentation for the new
  annotation

Test plan

• go build ./... clean
• go vet ./... clean (no new warnings)
• go test ./internal/k8s/... ./provider/kubernetes/... passes
• New unit tests cover both TrackedImages discovery and the
  checkForUpdate rewrite path for image volumes (resource_test.go,
  kubernetes_test.go)
• Manual verification on a Kubernetes 1.31+ cluster with the
  ImageVolume feature gate enabled

Closes #849