Home-build grafana-sidecar container (#281)

## Summary
- Home-build the k8s-sidecar container (`grafana-sidecar`) from forge mirror, replacing upstream `quay.io/kiwigrid/k8s-sidecar:1.28.0`
- Pinned to v1.28.0 — v2.x deferred due to 135% memory regression and readOnlyRootFilesystem crashloop
- Adds Dockerfile, service-versions entry, docs, and changelog fragment
- Manifest switch to home-built image pending container build

## Deployment and Testing
- [ ] `mise run container-build-and-release grafana-sidecar`
- [ ] Update kustomization.yaml with built image tag
- [ ] `argocd app set grafana --revision feature/grafana-sidecar && argocd app sync grafana`
- [ ] Verify sidecar logs and dashboards at https://grafana.ops.eblu.me
- [ ] Post-merge: `argocd app set grafana --revision main && argocd app sync grafana`

Reviewed-on: #281

docs/reference/services/grafana.md

@@ -19,6 +19,7 @@ Dashboards and visualization for BlumeOps observability.
 | **Namespace** | `monitoring` |
 | **Deployment** | Kustomize (`argocd/manifests/grafana/`) |
 | **Image** | `registry.ops.eblu.me/blumeops/grafana` |
+| **Sidecar Image** | `registry.ops.eblu.me/blumeops/grafana-sidecar` |
 
 ## Authentication
 
@@ -58,6 +59,7 @@ Optional annotation: `grafana_folder: "FolderName"`
 ## Related
 
 - [[build-grafana-container]] - Home-built container image
+- [[build-grafana-sidecar]] - Home-built sidecar container
 - [[kustomize-grafana-deployment]] - Kustomize manifest structure
 - [[authentik]] - OIDC identity provider for SSO
 - [[prometheus]] - Metrics datasource