upgrades: fix hourly gotenberg error + cap update notifications at weekly

Viktor was getting upgrade-error Slack messages every hour and wants
update notifications at most weekly. Root cause of the errors: Keel kept
trying to roll gotenberg 8.25->8.25.1 in paperless-ngx but kyverno's
require-trusted-registries denied it — gotenberg/* (and apache/*, which
tika will hit next) were never allowlisted, and Keel's Slack notifier at
info level re-posted the identical failure to #general on every hourly
poll since Jun 28.

Changes: allowlist gotenberg/* + apache/* so the patch applies cleanly;
disable Keel's direct Slack notifier and replace failure visibility with
a KeelUpdateFailing Loki-ruler alert (alert-on-change: one notification
plus the daily digest, never an hourly drip); remove diun's Slack
notifier whose default message @channel-pinged #image-updates for every
new upstream tag every 6h (the n8n upgrade-agent webhook feed is
untouched). The k8s upgrade report is already weekly (Mon 06:07 UTC).
Paperless-ngx itself stays paused (keel policy=never, user-managed) while
the ingest runs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/kyverno/modules/kyverno/security-policies.tf

@@ -345,10 +345,10 @@ resource "kubectl_manifest" "policy_require_trusted_registries" {
                   # 2026-06-05: mauriceboe (TREK group-trip planner trial).
                   "actualbudget/*", "afadil/*", "amruthpillai/*", "athomasson2/*",
                   "binwiederhier/*", "bitnami/*",
-                  "clickhouse/*", "cloudflare/*", "coturn/*", "crowdsecurity/*",
+                  "apache/*", "clickhouse/*", "cloudflare/*", "coturn/*", "crowdsecurity/*",
                   "curlimages/*", "deluan/*", "dgtlmoon/*", "dolthub/*",
                   "dpage/*", "dperson/*", "edoburu/*", "esanchezm/*",
-                  "freikin/*", "freshrss/*", "hackmdio/*", "hashicorp/*",
+                  "freikin/*", "freshrss/*", "gotenberg/*", "hackmdio/*", "hashicorp/*",
                   "headscale/*", "jhonderson/*", "kebe/*", "library/*",
                   "lissy93/*", "louislam/*", "matrixdotorg/*", "mauriceboe/*",
                   "mendhak/*",