fix(poll): seed digest watcher from the running image digest

The tag digest watcher stored the registry digest as its baseline at
registration and then immediately compared the registry against itself,
so a workload already running an older digest of a mutable tag produced
no event. The baseline lives only in the in-memory watched map, so this
happened on every Keel restart - https://github.com/keel-hq/keel/issues/845

Providers now report the digests a workload is actually running (from
pod container statuses) and the watcher seeds its baseline from them
when they no longer match the tag. The check is conservative: workloads
mid-rollout, images whose running digest is a child of the tag's image
index, and unresolvable manifests all keep the previous behaviour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Spec-Ref: helix-specs@48080040:000320_continue-on-these