feat: add operator-approved custom image profiles

[vicotrbb]

Summary

• add Helm-managed, operator-approved custom image profiles for hardened service sidecars and vetted workspace derivatives
• expose catalog selection through the API, CLI, and dashboard, and pin the resolved profile throughout lifecycle reconciliation
• enforce non-root high-port sidecars without credentials, PVC mounts, capabilities, or Kubernetes API access; add a safe NGINX fixture and Kind coverage
• document the configuration, architecture, API, CLI, operations, troubleshooting, and image-authoring contract
• harden Insights database-size collection against a SQLite WAL cleanup race found during end-to-end validation

Closes #34

Validation

• make lint
• make test (155 controller tests; 25 CLI tests)
• make helm
• hardened local NGINX container test
• full Kind end-to-end test via scripts/kind-e2e.sh