feat: support custom debugImage in Helm chart

[jacoblee-io]

Summary

• Add agentbox.debugImage to Helm values.yaml for specifying a private registry image used by node_exec/node_script debug pods
• Gateway deployment template injects SICLAW_DEBUG_IMAGE env when set
• Gateway /api/internal/settings endpoint includes debugImage in the exported config so AgentBox picks it up via settings.json

Without this, debug pods always pull busybox:latest from Docker Hub, which fails in air-gapped or private-registry environments.

Config flow: Helm values → Gateway env → /api/internal/settings → AgentBox settings.json → loadConfig().debugImage

Usage:

agentbox:
  debugImage: "my-registry.example.com/debug-image:latest"

Test plan

• npx tsc --noEmit passes
• All 864 tests pass
• Deploy with agentbox.debugImage set, verify node_script uses the configured image
• Deploy without agentbox.debugImage, verify fallback to busybox:latest

[LikiosSedo]

LGTM. Config flow is end-to-end verified:

Helm values.yaml (agentbox.debugImage)
  → Gateway env (SICLAW_DEBUG_IMAGE)
  → /api/internal/settings response
  → AgentBox settings.json → loadConfig().debugImage
  → node-exec / node-script / pod-nsenter-exec / netns-script / exec-utils

All downstream consumers already read loadConfig().debugImage with busybox:latest fallback. No code changes needed on the AgentBox side.

Minor note (non-blocking): debugImage is injected into the exportSettingsConfig() response alongside model/provider config, which is a slight mix of concerns. But metricsPort follows the same pattern, so this is consistent with the existing approach.