fix: harden app store install defaults

[bugkeep]

Summary

• apply the Bitnami legacy image fallback to the final values used by synchronous installs, persisted streaming installs, and upgrades
• derive only changed image paths from Helm's dependency-aware values instead of expanding all chart defaults or hard-coding application names
• show an explicit warning when the frozen bitnamilegacy snapshot and global.security.allowInsecureImages=true are enabled

Scope and compatibility

• only Bitnami's public community chart endpoints are rewritten; private registries and mirrors keep operator-provided values
• explicit image repositories and unrelated user values are preserved
• deprecated-chart policy and OCI download retry behavior are intentionally unchanged

Validation

• local behavior checks covered empty backend values, dependency aliases, minimal overrides, explicit repositories, private mirrors, malformed value shapes, and warning output
• gofumpt and the repository's exact Go tests/vet command passed
• one functional commit and no Go test files

Fix: casosorg#101