feat(build)/docs: make executor images configurable; document the build lane's real seams (#9, #10)

- [registry] gains kaniko_image / trivy_image / build_cpu_limit /
  build_mem_limit overrides; empty keeps the compiled-in defaults. An
  air-gapped or mirrored install has no route to gcr.io/aquasec (the
  build egress policy allows only DNS + registry + package mirrors), so
  builds previously could not even start their executors.
- deferred-seams: the uploads-context entry now records WHY a mount is
  impossible (PVCs cannot cross namespaces) and that the s3 lane also
  lacks credentials in the build Pod — options captured for the real fix.
- troubleshooting 8e (executor ImagePullBackOff + the overrides),
  13b rewritten (verified eviction refusal, 5m pressure-transition,
  image-GC recovery), 15 (upgrade/rollback runbook for Recreate).
- Backup semantics decided and documented: a backup is the whole /data
  volume (worlds + config + plugins + cache) and a restore rolls all of
  it back — OpenAPI/README wording updated to match (same-tag images are
  still watched for regressions by the openapi parity gate).

internal/config/config_test.go

@@ -47,6 +47,10 @@ metallb_pool = "192.0.2.200-250"
 [registry]
 url = "registry.felis.svc:5000"
 build_namespace = "felis-build"
+kaniko_image = "registry.felis.svc:5000/mirror/kaniko:v1.23.2"
+trivy_image = "registry.felis.svc:5000/mirror/trivy:0.58.1"
+build_cpu_limit = "1"
+build_mem_limit = "2Gi"
 
 [archive]
 store = "tarLocal"
@@ -84,6 +88,13 @@ func TestLoadValid(t *testing.T) {
 	if cfg.Archive.S3.Bucket != "felis-backups" {
 		t.Errorf("s3 bucket = %q", cfg.Archive.S3.Bucket)
 	}
+	if cfg.Registry.KanikoImage != "registry.felis.svc:5000/mirror/kaniko:v1.23.2" ||
+		cfg.Registry.TrivyImage != "registry.felis.svc:5000/mirror/trivy:0.58.1" {
+		t.Errorf("build image overrides = %q / %q", cfg.Registry.KanikoImage, cfg.Registry.TrivyImage)
+	}
+	if cfg.Registry.BuildCPULimit != "1" || cfg.Registry.BuildMemLimit != "2Gi" {
+		t.Errorf("build resource overrides = %q / %q", cfg.Registry.BuildCPULimit, cfg.Registry.BuildMemLimit)
+	}
 }
 
 func TestLoadAppliesDefaults(t *testing.T) {