tts: image is TF-owned — drop the copied KEEL ignore so the GHCR switch applies

The deployment's lifecycle.ignore_changes still ignored the container
image (copied from the keel-managed tripit pattern), which would have
made the previous commit's GHCR switch a silent no-op on apply. Keel
cannot poll the private GHCR repo anyway; the pinned sha tag is
terraform's to manage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/tts/main.tf

@@ -451,8 +451,9 @@ resource "kubernetes_deployment" "chatterbox" {
     ignore_changes = [
       # Off-peak CronJobs own the replica count — don't let apply reset it.
       spec[0].replicas,
-      spec[0].template[0].spec[0].dns_config,         # KYVERNO_LIFECYCLE_V1
-      spec[0].template[0].spec[0].container[0].image, # KEEL_IGNORE_IMAGE
+      spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
+      # image is TF-OWNED (pinned GHCR sha tag) — NOT keel-managed: keel can't
+      # poll the private GHCR repo, and the 2026-06-12 registry switch must apply.
       metadata[0].annotations["keel.sh/match-tag"],
       metadata[0].annotations["keel.sh/policy"],
       metadata[0].annotations["keel.sh/trigger"],