Pull images via artifactapi; make transform tier stateless

Three changes from review:

1. Pull every container image through the artifactapi dockerhub remote instead
   of direct upstream: clickhouse-server, altinity operator + metrics-exporter,
   bitnami/kubectl (crdHook), nats + nats-server-config-reloader, nats-box
   (bootstrap Job), and vector (all tiers + the CI image). Requires
   terraform-artifactapi#16 (dockerhub allowlist patterns) merged first.

2. Keep upstream official images (no Docker Hardened Images). DHI exists for
   clickhouse-server and vector but is subscription-gated and served from a
   private org namespace not reachable via the anonymous artifactapi dockerhub
   proxy; its shell-less images would also break the bash bootstrap Jobs and the
   shell-based vector-test CI step. Use vector's distroless-libc for runtime
   pods (near-hardened) and the debian variant only for CI.

3. Make the transform tier a stateless Deployment (was a StatefulSet): no PVC,
   no disk buffer — JetStream is the sole durability layer. The ClickHouse sink
   uses an in-memory block buffer so a ClickHouse outage back-pressures the
   JetStream pull source (unpulled messages are retained/redelivered). Add a CPU
   HPA (2-8) — safe because JetStream pull consumers distribute work across N
   replicas on the one durable consumer. Caveat documented: vector's NATS source
   has no end-to-end acks (acks on receipt), so a pod killed mid-outage can lose
   its in-memory buffer window; accepted trade for a stateless autoscaling tier.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

apps/base/logging/vector/aggregator.yaml

@@ -7,10 +7,13 @@
 # insert a transform and append its id to the clickhouse sink `inputs` — no edge
 # or VM rollout required.
 #
-# Durability model: JetStream (72h / 40GiB) is the outage buffer. If ClickHouse
-# is down the sink blocks, back-pressure stops acking, and JetStream retains
-# messages for replay. The local disk buffer is small (survives pod restarts of
-# in-flight events only).
+# Durability model: JetStream (72h / 40GiB) is the SOLE durability layer. This
+# tier is stateless (no PVC, memory buffer). If ClickHouse is down the sink
+# blocks (when_full=block); back-pressure stops the source pulling, so unpulled
+# messages stay in JetStream and are redelivered. NB: Vector's NATS source has
+# no end-to-end acks (acks on receipt), so a pod killed mid-outage can lose the
+# in-memory buffer's worth of already-pulled events — accepted for a stateless,
+# autoscalable tier.
 data_dir: /vector-data-dir
 
 api:
@@ -117,10 +120,11 @@ sinks:
       max_events: 500000
       max_bytes: 134217728
       timeout_secs: 10
-    # Small local buffer — JetStream is the real outage buffer now.
+    # Stateless: in-memory buffer, block on full so back-pressure reaches the
+    # JetStream pull source (which then stops acking). JetStream is durability.
     buffer:
-      type: disk
-      max_size: 2147483648
+      type: memory
+      max_events: 2000
       when_full: block
     healthcheck:
       enabled: true