fix(chart): let appVersion select the image instead of a pinned digest

[L30Bola]

🚀 What does this PR do?

Removes the version pinning introduced in #83

🔍 Why? (Context)

Because of that, we were updating the application and Helm Chart but we weren't shipping the actual changes.

Checklist

• Update the Helm chart version and/or appVersion if those are changed
• Updated docs/ or /README.md if needed

🧪 How this was tested? And test results

Tested locally. Check below comment

⚠️ Special care or coordination needed?

No special care needed.

[L30Bola]

Claude's debug:

┌──────────────────────────┬───────────────┬───────────────────────────────────────────────────────────────┐
│        Image ref         │ keess version │                    Metric names in binary                     │
├──────────────────────────┼───────────────┼───────────────────────────────────────────────────────────────┤
│ powerhome/keess:1.4.2    │ Keess v1.4.2  │ keess_goroutines_inactive, keess_remote_initialization_failed │
├──────────────────────────┼───────────────┼───────────────────────────────────────────────────────────────┤
│ pinned @sha256:e9c74d6e… │ Keess v1.3.3  │ keess_remote_initialized_success                              │
└──────────────────────────┴───────────────┴───────────────────────────────────────────────────────────────┘

I pulled each image, ran /app/keess version, then docker cp'd the binaries out and grepped them. So this change is what actually fixes the four dead Grafana panels and the two never-firing Prometheus alerts — not a hoped-for side effect.

The root cause, and why values.yaml alone wasn't enough

Renovate PR #83 (chore(deps): pin dependencies, 2026-07-06) is the culprit. Both tags were "" before it. Renovate's pinDigest resolved the empty tag — landing on latest, which was a 1.3.3 build at the time — and wrote it as a @sha256 override. Because image.tag outranks appVersion in the keess.image helper, the 1.4.0, 1.4.1 and 1.4.2 releases never shipped. That PR even carried a "Some dependencies could not be looked up" warning, which is why Renovate then went silent instead of updating the digest forward.

So reverting to tag: "" restores the exact precondition Renovate acted on last time — it would re-pin, probably within a day. I added a packageRules entry to renovate.json disabling these two images, since appVersion is their real version source and Renovate has nothing legitimate to track. That's outside the file you named; say the word and I'll drop it, but without it this fix has a shelf life.

Verified: chart defaults render :1.4.2, an explicit tag override still works, an explicit @sha256 override still takes the helper's digest branch (so deliberate pinning remains possible), renovate.json parses, helm lint clean.

[dgmorales]

We need to bump the helm chart version (not the app Version). So we then change that on pac addons defaults later, to fix our keess deployments.

Also I think we could revert this commit: b6f3d5f

that was added only for this undesired pinning to happen, and just makes the version logic more complex to understand.