Collect stash, voyager and virtual-secrets; retire the externals step

[ArnobKumarSaha]

Two changes, one goal: every image published by exactly one collector

1. Three more component installers

stashed, voyagermesh and virtual-secrets each own an installer with its own hack/scripts/update-catalog.sh and catalog/imagelist.yaml, exactly like the seven already in components, and appscode-cloud/installer pins an anchor chart for each — all three anchor tags verified to exist on the remote:

org	anchor	resolves to
stashed	stash	v2025.7.31
voyagermesh	voyager	v2026.3.23
virtual-secrets	virtual-secrets-server	v2026.2.27

Nothing was collecting them, so their images reached a release only by accident, via whichever other list happened to mention them.

New outputs: images/stashed.yaml, images/voyagermesh.yaml, images/virtual-secrets.yaml.

2. The externals step is retired

cert-manager, flux2, keda, keda-add-ons-http, kube-prometheus-stack and snapshot-controller are feature charts like any other. appscode-cloud/installer now renders them from the values their Feature actually carries and publishes the result as catalog/feature-chart-images.yaml (appscode-cloud/installer#1319); from-orgs copies that to images/feature-charts.yaml.

Rendering from the Feature is the more accurate of the two. The curated values had drifted:

# hack/ci/flux2-ci-values.yaml        # what the ACE Feature actually sets
kustomizeController:    create: true  #   create: false
notificationController: create: true  #   create: false

So the externals step was mirroring two controllers ACE never deploys.

main.go, Makefile and the workflow no longer invoke it. pkg/collect/externals.go and hack/ci/*-ci-values.yaml stay in the tree, referenced by nothing — it still compiles, since the helpers it uses (newLayout, chartVersion) remain in use by orgs.go.

What could have gone wrong, and didn't

from-orgs copied only catalog/imagelist.yaml per org — feature-chart-images.yaml was not collected. Dropping the externals step without also wiring that file in would have deleted cert-manager, flux2, keda, kube-prometheus-stack and snapshot-controller from all-images.yaml entirely. That copy is part of this PR.

The externals step also recovered three images that appear only as container flags, which image-packer could not see:

--acme-http01-solver-image=ghcr.io/appscode-images/cert-manager-acmesolver:v1.19.3
--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.80.0
--thanos-default-base-image=quay.io/thanos/thanos:v0.37.2

kmodules/image-packer#60 now collects those directly, verified to add no false positives (catalog/imagelist.yaml byte-identical across all of appscode-cloud/installer's charts). With that in, the new images/feature-charts.yaml is a superset of what the six externals files carried, minus only the two flux2 controllers ACE disables.

Ordering

Land kmodules/image-packer#60, cut a release, then appscode-cloud/installer#1319, then this. Running make collect before installer#1319 is merged yields no catalog/feature-chart-images.yaml and from-orgs fails loudly rather than silently dropping the images.