fix(observability): force Alloy config rollouts

[gregkonush]

Summary

• Keep the generated Alloy ConfigMap name stable for the Argo lovely plugin.
• Pin the Alloy pod template to the exact SHA-256 of its River configuration so config changes force a rollout.
• Enforce config/annotation parity in the existing observability contract test.

Related Issues

Follow-up to #12398.

Testing

• nix develop -c kustomize build --enable-helm argocd/applications/observability
• nix develop -c sh -lc 'kustomize build --enable-helm argocd/applications/observability | kubectl apply --dry-run=server -n observability -f -'
• bun run lint:argocd
• bun test packages/scripts/src (532 passing)
• bunx oxfmt --check packages/scripts/src/shared/__tests__/flink-observability-contract.test.ts

Screenshots (if applicable)

N/A. Manifest-only change.

Breaking Changes

None. The stable ConfigMap is recreated and the SHA annotation rolls Alloy once.

Checklist

• Testing section documents the exact validation performed.
• Screenshots and Breaking Changes sections are handled appropriately.
• Documentation, release notes, and follow-ups are updated or tracked; the config hash contract is covered in tests.