Localize Alloy container image (#300)

## Summary

- Add `containers/alloy/` with dual Dockerfile + Nix build files for Grafana Alloy v1.14.0
- Both builds fetch source from forge mirror (`forge.ops.eblu.me/mirrors/alloy.git`), build the web UI (Node), then compile the Go binary with `netgo embedalloyui` tags
- Update all three alloy deployments (alloy-k8s, alloy-ringtail, alloy-tracing-ringtail) to use `registry.ops.eblu.me/blumeops/alloy`
- `promtail_journal_enabled` tag omitted — requires systemd headers and none of our configs use `loki.source.journal`

## Build verification

- **Dockerfile:** Tested locally via `docker build`, binary reports `v1.14.0` with correct tags
- **Nix:** Tested on ringtail via `nix-build`, all three hashes (fetchgit, npmDeps, goModules) resolved and build succeeds

## Post-merge steps

1. Wait for CI to build the container from main (both Dockerfile and Nix workflows)
2. `mise run container-list alloy` to find the `[main]` tagged image
3. C0 follow-up to update `newTag` in all three kustomizations from `v1.14.0-placeholder` to the real tag
4. Sync ArgoCD apps and verify pods come up healthy

Reviewed-on: #300

argocd/manifests/alloy-k8s/daemonset.yaml

@@ -19,7 +19,7 @@ spec:
         fsGroup: 473  # alloy user group
       containers:
         - name: alloy
-          image: grafana/alloy:kustomized
+          image: registry.ops.eblu.me/blumeops/alloy:kustomized
           args:
             - run
             - --server.http.listen-addr=0.0.0.0:12345

argocd/manifests/alloy-k8s/kustomization.yaml

@@ -9,8 +9,8 @@ resources:
   - daemonset.yaml
 
 images:
-  - name: grafana/alloy
-    newTag: v1.14.0
+  - name: registry.ops.eblu.me/blumeops/alloy
+    newTag: v1.14.0-placeholder
 
 configMapGenerator:
   - name: alloy-config

argocd/manifests/alloy-ringtail/daemonset.yaml

@@ -19,7 +19,7 @@ spec:
         fsGroup: 473  # alloy user group
       containers:
         - name: alloy
-          image: grafana/alloy:kustomized
+          image: registry.ops.eblu.me/blumeops/alloy:kustomized
           args:
             - run
             - --server.http.listen-addr=0.0.0.0:12345

argocd/manifests/alloy-ringtail/kustomization.yaml

@@ -9,8 +9,8 @@ resources:
   - daemonset.yaml
 
 images:
-  - name: grafana/alloy
-    newTag: v1.14.0
+  - name: registry.ops.eblu.me/blumeops/alloy
+    newTag: v1.14.0-placeholder
 
 configMapGenerator:
   - name: alloy-config

argocd/manifests/alloy-tracing-ringtail/daemonset.yaml

@@ -18,7 +18,7 @@ spec:
       hostPID: true
       containers:
         - name: alloy
-          image: grafana/alloy:kustomized
+          image: registry.ops.eblu.me/blumeops/alloy:kustomized
           args:
             - run
             - --server.http.listen-addr=0.0.0.0:12346

argocd/manifests/alloy-tracing-ringtail/kustomization.yaml

@@ -8,8 +8,8 @@ resources:
   - daemonset.yaml
 
 images:
-  - name: grafana/alloy
-    newTag: v1.14.0
+  - name: registry.ops.eblu.me/blumeops/alloy
+    newTag: v1.14.0-placeholder
 
 configMapGenerator:
   - name: alloy-tracing-config