feat: switch to Chainguard zero-CVE images and fix config mount path

[llulioscesar]

Summary

• Switch all container images to Chainguard (valkey, kubectl, wolfi-base) for zero CVE
• Fix critical bug: config mount path changed from /opt/valkey/etc/valkey.conf to /etc/valkey/valkey.conf
• Update container user from 999 to 65532 (Chainguard default)
• Rewrite pre-upgrade hook for distroless kubectl compatibility
• Simplify health check scripts to work without timeout/awk/head commands

Test plan

• Standalone mode: 1/1 pod Running, PING returns PONG
• Sentinel mode: 6/6 pods Running (1 master, 2 replicas, 3 sentinels)
• Sentinel correctly detects master

Breaking Changes

• Container user changed from 999 to 65532 (may affect existing PVC permissions)