fix: harden app store install defaults

[bugkeep]

What this fixes

Bitnami charts can still reference versioned images that moved from the active bitnami namespace to the frozen bitnamilegacy namespace. Tomcat also ships with its default webapps disabled, so a technically successful install can expose no usable default page.

What changed

• show the same install-compatible values in the App Store dialog that the backend will enforce
• rewrite versioned Bitnami image values to canonical docker.io/bitnamilegacy/* references and enable the Bitnami legacy-image compatibility switch
• derive changes from Helm's coalesced dependency values, then merge only changed paths into user values
• enable tomcatInstallDefaultWebapps only when the chart declares that key and the user did not explicitly set it
• apply the same preparation to synchronous installs, persisted streaming installs, and upgrades

Scope and compatibility

Registry reachability and domestic/overseas mirror routing are intentionally not implemented here; that work remains isolated in casosorg#112. This PR contains no workflow, configuration, or OCI mirror fallback changes and always emits canonical official image references.

Non-Bitnami charts are unchanged. Explicit private image registries and explicit Tomcat values remain authoritative. Existing API payloads and Helm operation persistence are unchanged.

Validation

• repository's exact Go CI test and vet command
• go vet ./...
• go build ./...
• gofumpt clean
• temporary local behavior tests covered canonical legacy references, dependency aliases, minimal overrides, explicit private values, non-Bitnami charts, invalid values without mutation, and empty compatibility state
• no Go test files are included in the commit

Fix: casosorg#101