fix: align GOMEMLIMIT with pod memory limits and force fresh image pulls

Go's GC doesn't respect cgroup memory limits on its own, risking OOMKill
under load; set GOMEMLIMIT to ~90% of each deployment's resources.limits.memory.
Also switch imagePullPolicy to Always so :latest tags aren't served stale
from node-local cache after a new push.

k8s/charts/management-service/templates/deployment.yaml

@@ -22,6 +22,9 @@ spec:
               containerPort: {{ .Values.grpcPort }}
             - name: http
               containerPort: {{ .Values.httpPort }}
+          env:
+            - name: GOMEMLIMIT
+              value: {{ .Values.goMemLimit | quote }}
           envFrom:
             - configMapRef:
                 name: management-service-config