fix(grafana): manifest and curation move onto the fleet trust floor

The signed catalog has homed grafana at lfg2025/grafana:10.2.0 in the fleet
registry all along; the manifest still pulled Docker Hub's grafana/grafana,
so the repo-mismatch guard (correctly) discarded the catalog image on every
tick and warned every ~75s on every node. Registry verified to carry the
image; aligning the repo path makes the already-signed catalog entry
effective — no re-signing needed, no behavioural change beyond pull source.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app-catalog/catalog.json

@@ -390,7 +390,7 @@
       "author": "Grafana Labs",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "grafana/grafana:10.2.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/grafana:10.2.0",
       "repoUrl": "https://github.com/grafana/grafana",
       "containerConfig": {
         "ports": [

apps/grafana/manifest.yml

@@ -5,7 +5,7 @@ app:
   description: Analytics and monitoring platform. Visualize metrics and create dashboards.
   
   container:
-    image: grafana/grafana:10.2.0
+    image: source.archipelago-foundation.org/lfg2025/grafana:10.2.0
     image_signature: cosign://...
     pull_policy: if-not-present
     data_uid: "472:472"