fix: align GOMEMLIMIT with pod memory limits and force fresh image pulls

Go's GC doesn't respect cgroup memory limits on its own, risking OOMKill
under load; set GOMEMLIMIT to ~90% of each deployment's resources.limits.memory.
Also switch imagePullPolicy to Always so :latest tags aren't served stale
from node-local cache after a new push.

k8s/charts/management-service/values.yaml

@@ -4,7 +4,7 @@ replicaCount: 2
 image:
   repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service
   tag: latest
-  pullPolicy: IfNotPresent
+  pullPolicy: Always
 
 grpcPort: 9090
 httpPort: 8080
@@ -23,6 +23,12 @@ resources:
     cpu: "1"
     memory: 512Mi
 
+# Go's GC only reacts to GOGC by default and has no idea about the cgroup
+# memory limit above -- it'll happily grow heap until the kernel OOMKills it.
+# Setting GOMEMLIMIT to ~90% of the container limit makes the GC self-throttle
+# before that happens. Keep this in sync with resources.limits.memory.
+goMemLimit: "460MiB"
+
 hpa:
   enabled: true
   minReplicas: 2