One mechanism deploys this cluster

[ExtraToast]

Parent

#1289

What to build

Once the api and the frontend are pinned by digest, Keel drives one image — the Stalwart tooling sidecar — on a moving :latest, while everything else is a digest in git. Two deploy mechanisms means every incident starts by working out which one moved something.

Pin that image the same way and remove Keel entirely.

Renovate's rule disabling updates for this repository's own images says they "run on the :latest tag and are rolled by the deploy pipeline". The rule is still right; its stated reason stops being true. Correct it here.

Acceptance criteria

• The Stalwart tooling image is pinned by digest in git and rolls when that digest changes
• Keel, its HelmRelease, its HelmRepository and every keel.sh annotation are gone
• Renovate's rule for this repository's own images carries a reason that is true
• The docs describe one deploy mechanism

Blocked by

• The deployed version is a digest, written by the pipeline and checked before merge #1293 — the pinning pattern to copy