Wire INGESTOR_IMAGE_DIGEST into jobs-manager; drop digest requirement from ingestor subchart

[saadqbal]

What

Companion to tracebloc/client-runtime endpoint change. The ingestor image digest should be managed centrally (same pattern as every other component in the chart), so the customer-facing helm install tracebloc/ingestor flow doesn't need to pin it manually.

Scope

client/values.yaml:

• Add images.ingestor.digest: "" to the existing images: block.

client/templates/jobs-manager-deployment.yaml:

• Inject INGESTOR_IMAGE_DIGEST env on the api container, sourced from .Values.images.ingestor.digest. Nil-guard the access so --reuse-values from a pre-this-PR release doesn't crash templating.

ingestor/values.yaml + ingestor/templates/configmap-ingest-config.yaml + ingestor/README.md:

• image.digest becomes optional (override only). Drop from required values.
• Body JSON only includes image_digest when the customer explicitly sets it; otherwise jobs-manager uses its env-configured default.
• README documents auto-update model + the per-install override path.

ingestor/values.yaml image: block:

• Keep repository (for air-gapped mirroring). Remove the digest: "" required gate.

Bootstrap

Once both PRs land:

• Bump client/values.yaml's images.ingestor.digest to sha256:e6639b... (the current v0.3.0-rc1 digest) so end-to-end works without --set. Future ingestor releases land the same way — bump the digest, bump the chart version, customers' auto-upgrade picks it up.

Acceptance

• Customer runs helm install tracebloc/ingestor --set-file ingestConfig=./my.yaml (no image.digest) → install succeeds, jobs-manager uses cluster's configured digest.
• Customer can still pass --set image.digest=sha256:... for pinning.
• helm upgrade --reset-then-reuse-values from a pre-this-PR release works (no nil-pointer on the new images.ingestor key).
• helm unittest client/: still passes.

Refs

• Parent: tracebloc/client#86, shipped via feat(#86): ingestor Helm subchart + companion RBAC/service/authz for new ingestion endpoint #123.
• Endpoint side: see the companion ticket on tracebloc/client-runtime.