feat(notifications): report image digests in update notifications

For tag updates that keep the same tag (e.g. latest -> latest with the
force policy), the previous notification text carried no information
about what actually changed. Update notifications (preparing, success,
failure) now append the image digest when it is known:

  Successfully updated deployment ns/name latest (sha256:old)->latest (sha256:new)

- New digest comes from the event repository (poll trigger, GCR pubsub,
  ACR/Harbor/GHC registry webhooks provide it; others leave it empty).
- Previous digest is resolved from the workloads' running pods when
  observable, falling back (kubernetes provider) to the keel.sh/digest
  annotation, which now records the digest keel deployed last.
- Digests are also carried on notification metadata (previousDigest,
  newDigest), so webhook/audit consumers receive them structured.
- The kubernetes.io/change-cause annotation includes the digest
  transition as well.
- When no digest is known the traditional message shape is preserved.

Covered by provider unit tests; validated with the local k3s e2e suite.

Spec-Ref: helix-specs@97ae81a6:000382_lets-check-latest-latest

(cherry picked from commit a52c636a - feature/000376, identical to 606f75dc on feature/000377)