containers: config.image override for every container

[KA-ROM]

Why

Every container hardcodes its image pin, and a recipe can only change it if that container's author added a special case (three did, each differently: op-reth, lighthouse-*, helix-simulator). Bumping a version, or matching a real deployment's version, meant editing container files.

What

One rule instead: any container accepts config: { image: "…" } from its recipe or an --opt.

• utils/resolve.ts: buildContainerFor(def, ctx) builds through the prototype, then applies config.image if set.
• renderers/{k8s,podman,docker-compose}.ts: all three build containers through it (the only path there is).

{ name: "beacon-1", prototype: "lighthouse-beacon",
  config: { image: "docker.io/sigp/lighthouse:v8.2.0" } }

Notes

• Defaults are untouched: no container file changes, no pin moves.
• helix-simulator's existing config.image keeps working (same key, same precedence).
• Stacked on k8s: pod-unique port names and registry pull mode #12 (the BuilderNet recipe in #14 needs both).