fix(data): avoid OpenFGA image repulls

[casey-brooks]

Summary

• Set the OpenFGA chart image pull policy to IfNotPresent.
• Keeps local/bootstrap clusters from repeatedly pulling openfga/openfga:v1.12.0 after the init container has already used the imported image.
• This unblocked the latest-bootstrap local repro work for Chat-app E2E failures after llm-proxy version bump (agent replies / notifications / tracing) e2e#124 in an environment with intermittent registry TLS timeouts.

Related

• Chat-app E2E failures after llm-proxy version bump (agent replies / notifications / tracing) e2e#124

Validation

• terraform -chdir=stacks/data fmt -check
• terraform -chdir=stacks/data validate
• terraform -chdir=stacks/data apply -input=false -auto-approve

[casey-brooks]

Local validation

• terraform -chdir=stacks/data fmt -check — passed.
• terraform -chdir=stacks/data validate — passed.
• terraform -chdir=stacks/data apply -input=false -auto-approve — passed; OpenFGA reached Synced/Healthy after the pull policy change.

Test & lint summary

• Tests: not applicable for this Terraform-only bootstrap chart-values change.
• Lint/format: Terraform format check passed with no errors.