deploy(dev): point overlay at the real GHCR image, not the side-loaded one

Tonight's GitHub Actions runs (Publish Docker Image workflow) succeeded on
every commit, confirmed by pulling the manifest directly: sha-147660a
exists in ghcr.io/brvncde-dotcom/vncmail-plus-dev and its digest matches
the `latest` tag exactly. Unlike the prior sha-d0a1cee6 pin (built locally,
manually `ctr images import`-ed onto each node - see 9b5870ca), this tag is
a real, publicly pullable registry image: no side-loading needed, survives
a node rebuild, and includes everything through tonight's AI work
(P0 scaffolding, real local-Ollama wiring, the CSP fix that made it
actually reachable, aiAssistantEnabled defaulting on).

Does NOT deploy anything by itself - ArgoCD's vncmail-dev Application is
still manual-sync (see deploy/argocd/vncmail-dev-app.yaml), and this
session has no kubectl/cluster access to trigger that sync or verify the
rollout. Whoever next syncs (or restarts the deployment) picks this up
automatically via imagePullPolicy: IfNotPresent, which now works as a real
cache rather than a hard dependency on the side-loaded image.

deploy/k8s/overlays/dev/image-tag/kustomization.yaml

@@ -8,4 +8,4 @@ kind: Component
 images:
   - name: ghcr.io/brvncde-dotcom/vncmail-plus-dev
     newName: ghcr.io/brvncde-dotcom/vncmail-plus-dev
-    newTag: sha-d0a1cee6
+    newTag: sha-147660a