fix: image updater strategy from digest→newest-build with SHA tag filter

Root cause: image updater used 'digest' strategy with allow-tags=latest
but 'digest' requires a version constraint. Result: updater errored every
2min cycle and never promoted new images.

Fix:
- Strategy: newest-build (picks most recently pushed tag)
- Allow-tags: regexp:^[a-f0-9]{7}$ (matches 7-char git SHA tags from CI)
- Alias: app (matches ArgoCD app annotation)

infra/portfolio/base/deployment.yaml

@@ -7,8 +7,9 @@ metadata:
     app.kubernetes.io/name: portfolio
     app.kubernetes.io/component: web
   annotations:
-    argocd-image-updater.argoproj.io/image-list: portfolio=forgejo.riotpiao.com/rock/portfolio
+    argocd-image-updater.argoproj.io/image-list: app=forgejo.riotpiao.com/rock/portfolio
-    argocd-image-updater.argoproj.io/portfolio.update-strategy: latest
+    argocd-image-updater.argoproj.io/app.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/app.allow-tags: "regexp:^[a-f0-9]{7}$"
 spec:
   replicas: 2
   selector: