Fix registry overlay restart hook image

[cesaregarza]

Summary

• replace the registry overlay restart hook image with a pinned image that includes
• preserves the existing shell-based rollout restart/status script and RBAC

Validation

• docker run --rm --entrypoint /bin/sh alpine/k8s:1.33.4 -ec 'kubectl version --client=true --output=yaml >/dev/null && echo shell-ok'
• kubeconform -schema-location default -strict -summary -exit-on-error apps/agent-control-plane-registry-overlay/restart-hook.yaml
• kubectl create --dry-run=client -f apps/agent-control-plane-registry-overlay/restart-hook.yaml -o yaml >/tmp/restart-hook-dryrun.yaml
• git diff --check