Add :kustomized sentinel tag to manifest images, review devpi

Bare image references in manifests were ambiguous — unclear whether the
tag was intentionally omitted or managed by kustomize. Add :kustomized
sentinel to all 37 image refs overridden by kustomize images transformer.
Add sync notes for tailscale-operator proxyclass (CRD fields not processed
by kustomize). Mark devpi reviewed (6.19.1 is current).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

argocd/manifests/loki/statefulset.yaml

@@ -20,7 +20,7 @@ spec:
         runAsUser: 10001
       containers:
         - name: loki
-          image: grafana/loki
+          image: grafana/loki:kustomized
           args:
             - -config.file=/etc/loki/loki-config.yaml
           ports: