chore(flux): migrate image-automation API v1beta2 -> v1

Migrate image.toolkit.fluxcd.io/v1beta2 -> /v1 for ImageRepository,
ImagePolicy, and ImageUpdateAutomation ahead of the Flux v2.7+ upgrade
(cluster-upgrade-plan §3.2). Flux v2.4 (current) already serves /v1, so
migrating the manifests now is a safe no-op at runtime.

- catalog/render.py: r_image_automation emits v1 for ImageRepository/ImagePolicy
- platform/image-automation/{image-update-automation,per-service/pihole.example}
- conformance L3 hands-off-update chainsaw applies v1 CRs
- conformance L1 goldens re-rendered to match (apiVersion-only diff)

No spec-field changes required: all spec fields used (image, interval,
imageRepositoryRef, filterTags.pattern/extract, policy.semver.range,
sourceRef, git.*, update.strategy/path) are unchanged in v1; the v1
messageTemplate already uses .Changed (not the removed .Updated).
apps/ golden unaffected (canonical render uses --no-image-automation).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/image-automation/image-update-automation.yaml

@@ -15,7 +15,7 @@
 # flux-system install (bootstrap/flux/bootstrap.sh `--components-extra`), so the image.toolkit CRDs
 # pre-exist before reconcile — this CR applies cleanly without the F-MON1 controllers/configs split
 # (the CRD is present at bootstrap, exactly like GitRepository/Kustomization are). See README.md.
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageUpdateAutomation
 metadata:
   name: flux-image-automation

platform/image-automation/per-service/pihole.example.yaml

@@ -11,7 +11,7 @@
 #
 # See ./README.md for the field-by-field contract.
 # ---------------------------------------------------------------------------------------------------
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
 metadata:
   name: pihole
@@ -21,7 +21,7 @@ spec:
   interval: 6h                    # scan schedule; nearest Flux duration to cadence "0 4 * * *" (daily-ish)
   # provider: generic             # dockerhub anon; a pull secret goes here if registry rate-limits bite
 ---
-apiVersion: image.toolkit.fluxcd.io/v1beta2
+apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
   name: pihole