fix(minio): pin frozen community image and alert on image pull failure

MinIO deleted the community edition images upstream. An anonymous pull of
docker.io/minio/minio and quay.io/minio/mc returns HTTP 401, and the Docker Hub
API returns "object not found". talos-cp-1 dropped the cached image during the
DiskPressure event on 2026-09-22. The tenant pod was recreated on 2026-09-23 and
has been in ImagePullBackOff since. MinIO served no traffic for 13 days, which
put vault-0 and loki-0 into CrashLoopBackOff and left the paperless backups
stuck.

Pin the tenant to the last community release by digest, and repoint the two
minio/mc references at the archived Bitnami client image, also by digest. Alert
on ImagePullBackOff and on a pod that stays not ready, because neither case
raised any alert.

Refs: httphub.docker.io/v2/repositories/minio/minio/tags -> {"message":"object not found"}

k8s/infra/minio/minio-tenant.yaml

@@ -16,7 +16,10 @@ spec:
   # backend could not resolve minio-cluster-hl. Official images now need registry auth
   # (quay.io/minio/minio returns 401), so this pins a public mirror of the same upstream
   # release; swap it for the official image once MinIO registry credentials exist.
-  image: coollabsio/minio:RELEASE.2025-10-15T17-29-55Z
+  # The digest freezes those bytes, so a retag or a deletion on the mirror cannot break
+  # the pull again. The same digest already sits in the containerd cache on talos-cp-1,
+  # so the first start needs no registry access.
+  image: docker.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z@sha256:69b55a1c1c5dc285ce04db96689f5b2102317fc77a50680a1874ca6efd1c87f9
 
   # Disable operator auto-TLS: MinIO serves plain HTTP internally on 9000.
   # External TLS is terminated at nginx ingress (wildcard riotpiao-com-tls cert).