chore(flux): migrate image-automation API v1beta2 -> v1

Migrate image.toolkit.fluxcd.io/v1beta2 -> /v1 for ImageRepository,
ImagePolicy, and ImageUpdateAutomation ahead of the Flux v2.7+ upgrade
(cluster-upgrade-plan §3.2). Flux v2.4 (current) already serves /v1, so
migrating the manifests now is a safe no-op at runtime.

- catalog/render.py: r_image_automation emits v1 for ImageRepository/ImagePolicy
- platform/image-automation/{image-update-automation,per-service/pihole.example}
- conformance L3 hands-off-update chainsaw applies v1 CRs
- conformance L1 goldens re-rendered to match (apiVersion-only diff)

No spec-field changes required: all spec fields used (image, interval,
imageRepositoryRef, filterTags.pattern/extract, policy.semver.range,
sourceRef, git.*, update.strategy/path) are unchanged in v1; the v1
messageTemplate already uses .Changed (not the removed .Updated).
apps/ golden unaffected (canonical render uses --no-image-automation).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml

@@ -162,7 +162,7 @@ spec:
     interval: 30s
 ---
 # Flux ImageRepository (R-UPD)
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
 metadata:
   name: paas-demo
@@ -172,7 +172,7 @@ spec:
   interval: 1h0m0s
 ---
 # Flux ImagePolicy (R-UPD)
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
   name: paas-demo

conformance/tests/l1-rendering/default-deny-baseline-render/golden/expected.yaml

@@ -93,7 +93,7 @@ spec:
     interval: 30s
 ---
 # Flux ImageRepository (R-UPD)
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
 metadata:
   name: baseline-demo
@@ -103,7 +103,7 @@ spec:
   interval: 1h0m0s
 ---
 # Flux ImagePolicy (R-UPD)
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
   name: baseline-demo

conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml

@@ -212,7 +212,7 @@ spec:
         description: 'sonarr has been unreachable for 5m (SLI: up).'
 ---
 # Flux ImageRepository (R-UPD)
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
 metadata:
   name: sonarr
@@ -222,7 +222,7 @@ spec:
   interval: 1h0m0s
 ---
 # Flux ImagePolicy (R-UPD)
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
   name: sonarr

conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml

@@ -212,7 +212,7 @@ spec:
         description: 'sonarr has been unreachable for 5m (SLI: up).'
 ---
 # Flux ImageRepository (R-UPD)
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
 metadata:
   name: sonarr
@@ -222,7 +222,7 @@ spec:
   interval: 1h0m0s
 ---
 # Flux ImagePolicy (R-UPD)
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
   name: sonarr

conformance/tests/l3-fault-injection/hands-off-update/chainsaw-test.yaml

@@ -72,7 +72,7 @@ spec:
               # resolution — proving it advanced the selection with zero hand-authored change.
               # =========================================================================================
               kubectl -n "$NS" apply -f - <<'EOF'
-              apiVersion: image.toolkit.fluxcd.io/v1beta2
+              apiVersion: image.toolkit.fluxcd.io/v1
               kind: ImageRepository
               metadata:
                 name: podinfo
@@ -80,7 +80,7 @@ spec:
                 image: ghcr.io/stefanprodan/podinfo
                 interval: 1m
               ---
-              apiVersion: image.toolkit.fluxcd.io/v1beta2
+              apiVersion: image.toolkit.fluxcd.io/v1
               kind: ImagePolicy
               metadata:
                 name: podinfo-stable
@@ -94,7 +94,7 @@ spec:
                   semver:
                     range: '>=6.0.0 <7.0.0'
               ---
-              apiVersion: image.toolkit.fluxcd.io/v1beta2
+              apiVersion: image.toolkit.fluxcd.io/v1
               kind: ImagePolicy
               metadata:
                 name: podinfo-pinned