feature: pin/preload e2e workload images

[atkrad]

What problem would this solve?

v1 e2e (#37) accepts imagePullPolicy: Always and pulling nginx:latest from the network. That is a common flake source (registry rate limits, transient pull failures) and slows CI on cold runners.

What do you want?

Harden the e2e workload image path after #37:

• Pin a digest (or fixed tag) for the smoke image in the fixture / e2e copy.
• Optionally preload / cache the image into Kind nodes (reuse localkube LoadImage once proposal: load local images into the local cluster #30 exists, or Kind load in CI).
• Prefer stable pulls over :latest + Always for the e2e fixture only (do not change product defaults casually).

Depends on: #37. Related: #30 (load local images into the local cluster).

Alternatives considered

• Keep Always + :latest — simplest, flakier.
• Mirror nginx into GHCR under deployah-dev — more control, more ops.