Home-build grafana-sidecar container (#281)

## Summary
- Home-build the k8s-sidecar container (`grafana-sidecar`) from forge mirror, replacing upstream `quay.io/kiwigrid/k8s-sidecar:1.28.0`
- Pinned to v1.28.0 — v2.x deferred due to 135% memory regression and readOnlyRootFilesystem crashloop
- Adds Dockerfile, service-versions entry, docs, and changelog fragment
- Manifest switch to home-built image pending container build

## Deployment and Testing
- [ ] `mise run container-build-and-release grafana-sidecar`
- [ ] Update kustomization.yaml with built image tag
- [ ] `argocd app set grafana --revision feature/grafana-sidecar && argocd app sync grafana`
- [ ] Verify sidecar logs and dashboards at https://grafana.ops.eblu.me
- [ ] Post-merge: `argocd app set grafana --revision main && argocd app sync grafana`

Reviewed-on: #281

argocd/manifests/grafana/deployment.yaml

@@ -48,7 +48,7 @@ spec:
       containers:
         # Dashboard sidecar - watches ConfigMaps with grafana_dashboard=1
         - name: grafana-sc-dashboard
-          image: quay.io/kiwigrid/k8s-sidecar
+          image: registry.ops.eblu.me/blumeops/grafana-sidecar
           imagePullPolicy: IfNotPresent
           env:
             - name: METHOD

argocd/manifests/grafana/kustomization.yaml

@@ -13,8 +13,8 @@ resources:
 images:
   - name: docker.io/library/busybox
     newTag: 1.31.1
-  - name: quay.io/kiwigrid/k8s-sidecar
-    newTag: 1.28.0
+  - name: registry.ops.eblu.me/blumeops/grafana-sidecar
+    newTag: v1.28.0-49c8045
   - name: registry.ops.eblu.me/blumeops/grafana
     newTag: v12.3.3-d05d2fb