fix(zoo-operator): pin to :main (only published tag) — :v0.1.1 is NotFound

The operator Deployment pinned ghcr.io/zooai/operator:v0.1.1, but that tag (and
:main-amd64) return NotFound from GHCR — verified in-cluster: the v0.1.1
ReplicaSet went straight to ImagePullBackOff. The only tag zooai/operator CI
has published is :main. Pin to :main (imagePullPolicy: Always) so a fresh
apply actually starts the operator; switch to an immutable semver once CI cuts
one.

k8s/base/operator.yaml

@@ -30,8 +30,12 @@ spec:
         - name: hanzo
       containers:
         - name: operator
-          image: ghcr.io/zooai/operator:v0.1.1
-          imagePullPolicy: IfNotPresent
+          # :main is the only tag zooai/operator CI has published — :v0.1.1 and
+          # :main-amd64 are NotFound in GHCR (verified in-cluster), so pinning
+          # them makes the Deployment ImagePullBackOff. Track the floating tag
+          # until CI cuts an immutable semver, then pin x.y.z+.
+          image: ghcr.io/zooai/operator:main
+          imagePullPolicy: Always
           args: ["--namespace", ""]
           env:
             - name: OPERATOR_NAMESPACE