ci-pipeline-health: image :latest+Always — registry lost the 2fd7670d tag

The sha tag other claude-agent-service CronJobs pin no longer exists in
the Forgejo registry (node caches mask it); fresh pulls 404. Follow the
owned-app CronJob convention until infra#19 moves this image to ghcr.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/ci-pipeline-health/main.tf

@@ -19,10 +19,13 @@ variable "schedule" {
   default = "30 7 * * *"
 }
 
-# Mirrors stacks/claude-agent-service image tag — the image ships curl + jq.
+# :latest + Always per the owned-app CronJob convention. NOTE: the registry
+# no longer holds the sha tag the other claude-agent-service CronJobs pin
+# (2fd7670d) — they survive on node image caches only. When issue infra#19
+# migrates claude-agent-service to ghcr, repoint this image too.
 variable "image_tag" {
   type    = string
-  default = "2fd7670d"
+  default = "latest"
 }
 
 locals {
@@ -119,9 +122,10 @@ resource "kubernetes_cron_job_v1" "sweep" {
               name = "registry-credentials"
             }
             container {
-              name    = "sweep"
-              image   = local.image
-              command = ["/bin/sh", "/scripts/sweep.sh"]
+              name              = "sweep"
+              image             = local.image
+              image_pull_policy = "Always"
+              command           = ["/bin/sh", "/scripts/sweep.sh"]
               env_from {
                 secret_ref {
                   name = "ci-pipeline-health-creds"