k8s-image-tag-lint — fail CI before an unpinned image ships

Flag Kubernetes workloads using mutable image tags (:latest, no tag, or non-digest) and fail CI before an unpinned image ships.