fix(k8s): drop imagePullSecrets - the ghcr package is confirmed public

Blocking the very first real deploy of the sandbox: base/deployment.yaml
referenced an imagePullSecrets entry ("ghcr-pull") that was never created,
which fails pod startup regardless of whether the image needs auth at
all - kubelet errors trying to resolve the named secret before it gets
anywhere near actually pulling.

Confirmed by execution (anonymous GHCR token, pull succeeded) that
ghcr.io/brvncde-dotcom/vncmail-plus-dev is public. Removing the block is
deploy/k8s/README.md's own documented alternative for exactly this case.

deploy/k8s/base/deployment.yaml

@@ -23,14 +23,14 @@ spec:
         fsGroup: 1001
         runAsUser: 1001
         runAsGroup: 1001
-      # ghcr package is private by default — see deploy/k8s/README.md to create
-      # this pull secret. Delete this block if you make the package public.
-      # NOTE: once CI moves to pushing registry.gitlab.vnc.biz images (the
-      # dev-auto-deploy phase of the GitLab pipeline), this needs to become a
-      # docker-registry secret for that registry instead — comments only,
-      # deliberately not renamed here, so this file stays a no-op today.
-      imagePullSecrets:
-        - name: ghcr-pull
+      # Confirmed 2026-08-05: ghcr.io/brvncde-dotcom/vncmail-plus-dev IS public
+      # (anonymous token pull succeeded) — no imagePullSecrets needed. This is
+      # deploy/k8s/README.md's own documented alternative to creating a
+      # ghcr-pull secret. Removed rather than left referencing a
+      # not-yet-created secret, which would otherwise block every pod from
+      # starting regardless of the image being public (kubelet fails to
+      # resolve a missing imagePullSecrets entry before it ever gets to
+      # deciding whether auth was actually required).
       containers:
         - name: vncmail-plus
           # Default/legacy value — CI overrides the image per-deploy via