[chore] update image helper

[ipaqsa]

What

Teaches every image helper about Module.Package, and adds the Embedded flag.

Until now only helm_lib_module_image knew about module packages. The other helpers
always read the platform image map, so helm_lib_module_image_digest could return a
different digest than helm_lib_module_image had just resolved for the same container.
All six helpers now follow one rule:

context	resolved from
.Module.Package present, no module name given	the module's own package
.Module.Package present, <module-name> given	the platform map — another module's images only live there
no .Module.Package	the platform map, exactly as before

Embedded packages. A package's images are either built into the platform image set
or pulled next to the package in a module registry:

Module.Package.Embedded	resolved image
falsy / absent (as today)	<Package.Registry.repository>/<Package.Name>@<digest>
true	<global.modulesImages.registry.base>@<digest>

An embedded image is already in the platform registry, so it is addressed by digest
alone — no package-name path segment — and neither Package.Registry.repository nor
Package.Name is required for it to resolve.

Common images stay platform images. helm_lib_module_common_image* keeps reading
global.modulesImages.digests.common for packaged and legacy modules alike; a packaged
module does not ship its own copy of kubeRbacProxy and friends.

Deduplication

Four internal helpers absorb logic that was copy-pasted across the public helpers:

helper	replaces
helm_lib_internal_module_own_package	the package-vs-platform decision, now made in one place
helm_lib_internal_module_package_registry_base	the package registry path, incl. the Embedded split
helm_lib_internal_module_raw_name	the if ge (len .) 3 / else-chart-name block, duplicated 4×
helm_lib_internal_module_registry_base	the 10-line external-registry override block, duplicated 2×

That override block is how the two override paths silently drifted apart:
helm_lib_module_image appends the kebab-cased module name to the override host,
helm_lib_module_image_no_fail appends .Chart.Name. The difference is preserved, but
it is now one argument at a call site with a comment, instead of two buried blocks.

Compatibility

A context without .Module.Package resolves exactly as before — same image, same digest,
same registry base, same failure message in the same order. Behavior changes only for
contexts that carry a package, which is the point of the PR.

Deliberately not changed

Pre-existing quirks, kept so the legacy path stays bit-for-bit identical. Each is worth
a follow-up:

• helm_lib_module_image / helm_lib_module_image_no_fail look the digest up in the
  platform map with a three-argument index, which raises index of nil pointer for a
  module absent from global.modulesImages.digests — so _no_fail does fail for an
  unknown module. The _digest* helpers use | default dict and return empty instead.
• On the package path the failure message omits the module prefix
  (Image <container> has no digest).
• The kebab-case / .Chart.Name asymmetry of the override path described above.

Tests

make ci/tests/unit — 84 suites, 375 tests, all passing. The package fixture gained a
Values.global block so it matches the shape of a real root context and lost its stale
Deckhouse.modulesImages block, which no longer exists in the values and was read by
nothing. Two documents were added: one for embedded packages, one exercising every
helper against a package.

Beyond the suite, the old and the new template were rendered against 44 call
combinations — both context shapes, present/absent/quoted/kebab-cased module names, the
override set and unset, embedded and downloaded packages, and every failure path. All 26
legacy-context cases are byte-identical, error messages included; the differences are
confined to package contexts and are the intended ones.

make doc/diff is clean; README.md is regenerated in the same commit.