arrstack: use canonical upstream image names

rke2 registries.yaml already mirrors upstream pulls through artifactapi,
so manifests must carry canonical upstream names.

apps/base/arrstack/arrproxy/migrate-job.yaml

@@ -35,7 +35,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
+          image: docker.io/library/postgres:18-alpine
           imagePullPolicy: IfNotPresent
           env:
             - name: HOME

apps/base/arrstack/arrproxy/oauth2-proxy-deployment.yaml

@@ -35,7 +35,7 @@ spec:
         # identity.unkin.net serves a Vault-PKI cert; combine the system roots
         # with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
         - name: combine-certs
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
+          image: docker.io/library/alpine:3
           imagePullPolicy: IfNotPresent
           command:
             - sh

apps/base/arrstack/valkey/valkeycluster.yaml

@@ -28,7 +28,7 @@ metadata:
 spec:
   shards: 1
   replicas: 2
-  image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
+  image: docker.io/valkey/valkey:9.0.0
   exporter:
     enabled: false
   scheduling: