feat: allow Engram-level image override for development and testing

[lanycrost]

Summary

There is no way to override the container image at the Engram level. The image is defined on the cluster-scoped EngramTemplate. To test a patched engram, you must patch the EngramTemplate, which affects all namespaces and all stories that reference it.

Reproduction

spec:
  templateRef:
    name: livekit-bridge
  overrides:
    image: ghcr.io/bubustack/livekit-bridge-engram:0.1.3-fix  # rejected

Error: strict decoding error: unknown field "spec.overrides.image"

Impact

During development we needed to test a patched livekit-bridge image for the chat example. The only option was:

kubectl patch engramtemplate livekit-bridge --type=merge \
  -p '{"spec":{"image":"...0.1.3-fix"}}'

This changed the image for every story using livekit-bridge across all namespaces, including the working voice example.

Expected behavior

Engrams should support an image override:

spec:
  templateRef:
    name: livekit-bridge
  overrides:
    image: ghcr.io/bubustack/livekit-bridge-engram:0.1.3-fix

This would let developers iterate on engram fixes in a single namespace without affecting production stories.

Relevance to registry

For the future engram registry with I/O validation and compatibility badges, per-engram image overrides are essential — you need to test candidate versions in isolation before promoting them to the template.