Localize kube-state-metrics container (Dockerfile + nix) (#327)

## Summary

- Build kube-state-metrics v2.18.0 locally from forge mirror, replacing upstream `registry.k8s.io` image
- Dockerfile (two-stage Go build) for indri/minikube
- default.nix (buildGoModule + buildLayeredImage) for ringtail/k3s
- Both kustomization files updated with `newName` pointing to local registry

## Verification

- [x] Nix build succeeded on ringtail (`nix-build` → 10-layer image)
- [x] Dockerfile build succeeded locally (`dagger call build` → ~2min)
- [x] `container-version-check --all-files` passes (2.18.0 consistent across Dockerfile, nix, service-versions.yaml)
- [ ] CI builds container images from this branch
- [ ] Update kustomization `newTag` with SHA-tagged version from CI
- [ ] ArgoCD sync on both clusters

## Test plan

- Trigger CI build: `mise run container-build-and-release kube-state-metrics`
- Verify tags: `mise run container-list kube-state-metrics`
- Update newTag in kustomization files with CI-produced tag
- Sync ArgoCD on indri: `argocd app sync kube-state-metrics`
- Sync ArgoCD on ringtail: `argocd app sync kube-state-metrics --context=k3s-ringtail` (note: argocd uses its own auth, not kubectl context)
- Verify metrics still flowing to Prometheus

Reviewed-on: #327

argocd/manifests/kube-state-metrics-ringtail/kustomization.yaml

@@ -6,4 +6,5 @@ resources:
   - service.yaml
 images:
   - name: registry.k8s.io/kube-state-metrics/kube-state-metrics
-    newTag: v2.18.0
+    newName: registry.ops.eblu.me/blumeops/kube-state-metrics
+    newTag: v2.18.0-e2e35cc-nix

argocd/manifests/kube-state-metrics/kustomization.yaml

@@ -6,4 +6,5 @@ resources:
   - service.yaml
 images:
   - name: registry.k8s.io/kube-state-metrics/kube-state-metrics
-    newTag: v2.18.0
+    newName: registry.ops.eblu.me/blumeops/kube-state-metrics
+    newTag: v2.18.0-e2e35cc