feat(images): mirror the kagent line, the Substrate line and the Flux controllers under their upstream paths

[teemow]

Closes #1229.

What

Three sets of images the agent-platform charts pull from ghcr.io get a gsoci copy whose destination keeps the upstream path (nested repositories, as the strimzi entries already do), so a consumer changes one registry value per line and keeps the repositories and digests the charts publish:

Source	Destination	Tags
ghcr.io/giantswarm/kagent/{controller,ui,golang-adk,claude-harness}	gsoci.azurecr.io/giantswarm/kagent/<image>	release tags X.Y.Z-gs.N from 0.11.0-gs.16
ghcr.io/giantswarm/substrate/{ateapi,atecontroller,atelet,atenet,podcertcontroller,ateom-gvisor}	gsoci.azurecr.io/giantswarm/substrate/<component>	release tags X.Y.Z-gs.N from 0.0.30-gs.4
ghcr.io/fluxcd/{source-controller,helm-controller}	gsoci.azurecr.io/giantswarm/fluxcd/<controller>	>= v1.9.0 / >= v1.6.0 (the Flux 2.9 line)

• kagent entries in images/renamed-kagent.yaml; Substrate in a new images/renamed-substrate.yaml (added to the retag-renamed-images matrix); the Flux controllers in images/renamed-images.yaml next to the flattened fluxcd-* copies, which the flux-operator cannot compose from one registry value.
• The release-tag filter with a prerelease semver floor is the agentgateway line's pattern: dev builds (X.Y.Z-dev.…) and SBOM tags (sha256-….sbom) stay in ghcr.
• The kagent chart references golang-adk and claude-harness by the index digest stamped at publish. skopeo copy --all copies the index unchanged, so the digest resolves at the destination as well.
• No code change: override_repo_name is used verbatim in the destination, so a slash keeps a nested path. Its comment (in main.go and the README copy) now says so.

Tests

• TestFilterTags pins the tag selection of these shapes: the -gs.N filter with a prerelease floor keeps 0.11.0-gs.16, 0.11.0-gs.20, 0.11.1-gs.1, drops 0.11.0-gs.15, dev and SBOM tags; the plain >= v1.9.0 floor drops release candidates and non-semver tags.
• TestRenamedImagesFiles parses every images/renamed-*.yaml the way retagger run does and validates each entry (semver constraint, filter and pattern compile), so a broken entry fails in CI rather than in the nightly run.
• go test ./..., golangci-lint (pre-commit) and yamllint (the validate-images-yaml config) pass locally.

Verification after merge

build_retag on main copies the tags. Then crane digest on source and destination must agree for golang-adk and claude-harness at the chart's stamped digests, and crane manifest must resolve every Substrate component at 0.0.30-gs.4 and the two Flux controllers. The evidence goes on #1229.