feature: pin/preload e2e workload images #41

e2e preloads AllowedE2EImages into Kind via localkube.LoadImage in SetupSuite. Specs that use any other image fail at fixture load.

Smoke fixtures still use nginx:latest, so Helm still sets imagePullPolicy: Always. That flakes on registry rate limits even after preload.

Pin a digest (or a fixed tag, not latest) on the e2e smoke images. Change the fixture and allowlist only; do not change product defaults.

Related: #30 (CLI cluster load-image; e2e already calls Manager.LoadImage directly).