feat: configure uv bootstrap image

[w9n]

Summary

• add an optional spec.runtimeDeps.uvImage repository, tag, and digest override
• apply the same resolved image to the built-in init-uv and init-python containers
• support the override through OpenClawClusterDefaults with instance-level precedence
• preserve the current uv image and registry-mirror behavior when the field is omitted
• regenerate deepcopy code, both CRDs, Helm and OLM copies, samples, and API docs

Why

The operator always injects init-uv, and it also uses the same image for the optional Python runtime installer. Users cannot currently pin that operator-owned image by digest without replacing operator behavior. Kubernetes documents that digests are immutable while tags can move, and its security checklist recommends digest references or signature verification.

• https://kubernetes.io/docs/concepts/containers/images/
• https://kubernetes.io/docs/concepts/security/security-checklist/

The field is component-local and follows the image-resolution behavior of the other managed sidecars: digest takes precedence over tag and spec.registry can still mirror the resolved reference.

Compatibility and rollback

Existing instances render the same ghcr.io/astral-sh/uv:0.6-bookworm-slim image. The CRD changes are additive. Removing runtimeDeps.uvImage restores the existing default; reverting this commit removes the API field entirely.

A cluster default applies only when an instance omits uvImage. The existing runtime-dependency boolean OR-merge behavior is unchanged.

Validation

• make test
• make lint
• make generate sync-chart-crds sync-bundle-crds api-docs
• git diff --check
• strict MkDocs build with matching ephemeral Nix Python and Cairo libraries
• focused tests cover default compatibility, custom tags, digest precedence, registry mirroring, both uv-based init containers, deep-copy isolation, and cluster-default precedence