chore(templates): align Derper pull secret config

[cuisongliu]

Summary

• align Derper with the safe non-DB kb-0.9 project-level config by adding the existing app pull secret reference
• keep raw asset URLs on labring-sigs/templates/main/template/derper/...
• do not add images.txt, change image tags, introduce latest/digest refs, or remove platform.json

Included projects

• derper

Skipped projects

• deeplx: only kb-0.9 raw URL/no-newline differences; already uses labring-sigs main asset URLs on main
• drizzle-studio: DB-facing template and source diff would also move image to latest
• enshrouded: source diff would unpin helper images to floating tags; README/logo differences are low-value or already handled on main
• fireboom: source diff would switch the fixed tag form back to digest/kb-0.9 raw URLs
• illa-builder: only kb-0.9 raw URL differences
• inpaint-web: source diff would remove the explicit latest tag / raw URL changes only
• it-tools: only kb-0.9 raw URL / low-value metadata text formatting differences
• jsoncrack: source diff would switch from tag to digest plus kb-0.9 raw URLs
• kitten-tts: only formatting and kb-0.9 raw URL differences

Validation

• ruby -e 'require "yaml"; YAML.load_stream(File.read("template/derper/index.yaml")); puts "yaml ok template/derper/index.yaml"'
• git diff --check
• python3 - <<'PY' ... platform ok template/derper/platform.json: ['amd64'] ... PY
• python3 - <<'PY' ... scope/url/image guard ok ... PY
• test ! -e template/derper/images.txt && echo 'no images.txt for derper'