Support image digest in worker pod template image

[PreethamSanji]

Closes: #58625

Issue

The airflow_image helper supports repository@digest (digest takes precedence over tag), but pod_template_image only rendered repository:tag. As a result, worker pods created from the pod template ignored digests and could run stale images when a mutable tag like latest was reused.

Fix

This PR makes pod_template_image mirror airflow_image: it introduces images.pod_template.digest (added to values.yaml and values.schema.json — the schema has additionalProperties: false for this block), falling back to defaultAirflowDigest, consistent with the existing repository/tag fallback chains.

Before
(helm template chart --set executor=KubernetesExecutor --set defaultAirflowRepository=my-repo --set defaultAirflowDigest=sha256:abc123):
helm template chart \ --set executor=KubernetesExecutor \ --set defaultAirflowRepository=my-repo \ --set defaultAirflowDigest=sha256:abc123 2>/dev/null \ | grep "image: my-repo" | sort -u

      `image: my-repo:3.3.0`
      `image: my-repo@sha256:abc123`

After (same values):
helm template chart \ --set executor=KubernetesExecutor \ --set defaultAirflowRepository=my-repo \ --set defaultAirflowDigest=sha256:abc123 2>/dev/null \ | grep "image: my-repo" | sort -u

      `image: my-repo@sha256:abc123`

Runtime caveat, documented in the new value's description:
the chart defaults config.kubernetes_executor.worker_container_repository/worker_container_tag to images.airflow.repository:tag, and when both are set the KubernetesExecutor overrides the pod template's base container image with that repo:tag string (kube_config.py builds kube_image; PodGenerator.construct_pod reconciles it over the base pod).

Since repo:tag cannot express a digest, the digest only takes effect when those two config options are unset — the same pre-existing limitation already documented for images.pod_template.repository/tag.

Making those config defaults digest-aware (defaulting them to empty when a digest is configured, so the template image wins) would fix the reporter's scenario with zero config changes, but it changes default behavior, happy to do that here or as a follow-up if preferred.

Tests: parametrized rendering tests in test_pod_template_file.py covering tag-only, digest-only, digest precedence over tag, and the defaultAirflowDigest fallback.

flower_image has the same gap; I'd address it separately if wanted.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)
  Claude Fable 5

Generated-by: [Claude Fable 5] following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[Miretpl]

Nice catch!

Could you also format the description of the PR a bit more? It would make it a bit easier to read.

[boring-cyborg]

Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions.

[github-actions]

Backport successfully created: chart/v1-2x-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	chart/v1-2x-test