personal-stack: tag->release + Flux version-pinning, drop Keel :latest

[jorisjonkers-dev-agents]

Objective: deploy a specific personal-stack version; retire main-is-the-deploy.

Work:

• release-please tagging vX.Y.Z; build images tagged with the version (keep :sha)
• Release PR bumps EXPLICIT image tags in platform/cluster/flux/**
• Remove keel.sh/policy: force + :latest from in-house Deployments
• Document deploy = reconcile tag, rollback = git revert

Part of #605.

[jorisjonkers-dev-agents]

Scaffold merged in #623 (release-please, version-tagged images on tag push, runbook). REMAINING (separate sequenced PR): pin Flux in-house image tags :latest->:X.Y.Z and remove Keel force/:latest across platform/cluster/flux/** — must land only after the first vX.Y.Z release builds versioned images.

[jorisjonkers-dev-agents]

Model corrected (operator). personal-stack stays continuously deployed (Flux + Keel :latest auto-roll); it is NOT version-pinned/tag-deployed. The release-please + version-on-tag + manual-deploy work is reverted in #624, and the held Flux-pinning/Keel-removal is cancelled — Keel stays. SemVer versioning + Renovate pinning now apply only to the sub-packages (extracted libs/tooling, reusable workflows, and the future API/frontend pair repos — see the new M7 issue). renovate.json is retained for consuming those pinned versions.