feat: add container sha as optional field to package

[t0mmylam]

Adds optional containerSHA field to package specs

Changes

API & CRD:

• Added containerSHA field to Package spec and PackageStatus
• Updated CRD and Helm chart with new field

Implementation:

• Added getPackageImage() helper to use digest format (image@sha256:...) when containerSHA is specified
• Updated pod creation to pull images by digest when available
• Propagated containerSHA through PackageSkyhook annotations and NodeState.Upsert()

Testing:

• Updated all unit tests to handle new parameter
• Updated e2e test to use real multi-arch manifest digest for agentless:1.2

Usage

packages:
  my-package:
    version: "1.0"
    image: ghcr.io/example/image
    containerSHA: "sha256:abc123..."  # Optional: ensures exact image

When specified, Kubernetes pulls image@sha256:... instead of image:version, guaranteeing the exact container regardless of tag changes.