image-updater: filter to SHA tags only (skip :latest)

allow-tags: regexp:^[0-9a-f]{7}$ ensures newest-build strategy
compares commit SHA tags, not the stale :latest tag

k8s/argocd/apps/50-messaging.yaml

@@ -89,6 +89,7 @@ metadata:
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: op=forgejo.riotpiao.com/rock/kmsvc-manage
     argocd-image-updater.argoproj.io/op.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/op.allow-tags: regexp:^[0-9a-f]{7}$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
@@ -114,6 +115,7 @@ metadata:
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: svc=forgejo.riotpiao.com/rock/kmsvc-manage
     argocd-image-updater.argoproj.io/svc.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/svc.allow-tags: regexp:^[0-9a-f]{7}$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab

k8s/argocd/apps/55-api-gateway.yaml

@@ -39,6 +39,7 @@ metadata:
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: gw=forgejo.riotpiao.com/rock/api-gateway
     argocd-image-updater.argoproj.io/gw.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^[0-9a-f]{7}$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab

k8s/argocd/apps/60-applications.yaml

@@ -249,6 +249,7 @@ metadata:
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: app=forgejo.riotpiao.com/rock/portfolio
     argocd-image-updater.argoproj.io/app.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^[0-9a-f]{7}$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab