feat: add global.imageTag for the four single-repo services

[mosoriob]

Phase 2.2 of the single-repo cutover runbook.

Every commit in mintproject/monorepo will build an image for four services.
One tag then names the whole system state. global.imageTag sets that tag.

Merge order. Merge mintproject/mint-ui-lit#661
first, let its main build finish, and make the GHCR package public. This PR
points the chart at ghcr.io/mintproject/mint-ui-lit. Merged first, it points
production at an image that does not exist.

What consumes the key

Verified by rendering the chart with every optional component enabled and
global.imageTag=SENTINEL. It reaches exactly 5 sites in 4 services:

Template	Image
hasura.yaml	ghcr.io/mintproject/graphql-engine
post-install-hasura.yaml	the same image, so the migration job matches the deployment
model-catalog.yaml	ghcr.io/mintproject/model-catalog-api
ui-react.yaml	mintproject/mint-ui-react
ensemble-manager.yaml	mintproject/ensemble-manager

It reaches none of cromo, mic-web, mic-api, data-catalog,
data-catalog-db, model-catalog-endpoint, model-catalog-explorer,
mint-ui-lit, postgres, postgis or the auth webhook. Each keeps its own pin.

The change is additive

Precedence is image.tag, then global.imageTag, then .Chart.AppVersion.

Test	Result
Default values, --set global.imageTag=SENTINEL	0 occurrences. The per-service tag wins.
Four tags cleared, --set global.imageTag=SENTINEL	5 occurrences, in the 5 sites above.
helm lint charts/mint	0 failures.

dynamo sets every tag per service, so it needs no change on cutover day. The
2 forks of this chart do not break.

Packaging

Chart 9.0.0-beta.6 becomes 9.0.0-beta.7. make release adds
releases/MINT-9.0.0-beta.7.tgz and one index.yaml entry: 133 entries become
134, none removed. Nothing pins the new version yet, so this reverts by removing
one .tgz.

charts/mint/README.md is left alone. The docs.yaml workflow regenerates it
with helm-docs on this pull request.

Two gaps the runbook does not schedule

Neither blocks this PR. Both block the Phase 9 dev-cluster proof.

1. components.ui_react.image.repository and
   components.ensemble_manager.image.repository still name Docker Hub. Their
   GHCR images do not exist yet, so this PR leaves them alone. They must move
   before Phase 9 deploys global.imageTag=0.1.0.

2. The chart's own default values pin all four services per service. Phase 9
   must therefore clear them, or global.imageTag has no effect:

   helm upgrade ... --set global.imageTag=0.1.0 \
     --set components.hasura.image.tag=null \
     --set components.model_catalog_api.image.tag=null \
     --set components.ui_react.image.tag=null \
     --set components.ensemble_manager.image.tag=null