ip-algo: rename pod field to app; image from pod spec

The `pod` field hashed pod.Name, which differs per replica because of
the ReplicaSet pod-template-hash + 5-char random suffix. With
namespace,pod,image, all replicas of the same Deployment got distinct
hextets even though they were the same workload.

Replace `pod` with `app` — a stable workload identifier derived from
the controller chain:

  - Deployment → ReplicaSet → Pod: strip the pod-template-hash suffix
    from the RS name (`traefik-789df685f` → `traefik`).
  - StatefulSet/DaemonSet/Job → Pod: use controller name as-is.
  - Bare pod: pod name.

Image now comes from pod.Spec.Containers[0].Image (the spec'd
reference). 64-hex-char values are treated as sha256 digests and
parsed as before; everything else (image:tag, short SHA) is FNV-1a-64'd
as a string. This makes `traefik:v3.5` deterministic across replicas
without needing the runtime-resolved digest.

Net effect: namespace,app,image yields identical hextets across all
replicas of the same Deployment except the trailing random N nibble.

embed.Values.Pod → App; AllocRequest.Pod kept for log context only,
new App and Image fields drive the embed call. handlers.go computes
both via deriveAppName + podImageRef helpers.

Tests: 7 new TestDeriveAppName_* cases (Deploy/STS/DS/bare/RS-without-
hash/non-controller-owner) + TestPodImageRef. Existing fuzz seeds
updated for the new keyword.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

pkg/agent/annotations_test.go

@@ -179,10 +179,10 @@ func TestParseAnnotations_BoolCaseInsensitive(t *testing.T) {
 // "all three mean unset".
 
 func TestResolveIPAlgo_PodWins(t *testing.T) {
-	pod := map[string]string{annotationPrefix + annIPAlgo: "namespace,pod"}
+	pod := map[string]string{annotationPrefix + annIPAlgo: "namespace,app"}
 	node := map[string]string{annotationPrefix + annIPAlgo: "image"}
 	got := ResolveIPAlgo(pod, node, nil)
-	want := []embed.Field{embed.FieldNamespace, embed.FieldPod}
+	want := []embed.Field{embed.FieldNamespace, embed.FieldApp}
 	if !equalFields(got, want) {
 		t.Fatalf("got %v, want %v", got, want)
 	}
@@ -210,9 +210,9 @@ func TestResolveIPAlgo_PodEmptyFallsToNode(t *testing.T) {
 func TestResolveIPAlgo_PodInvalidFallsToNode(t *testing.T) {
 	for _, podVal := range []string{"namespace,bogus", "ns", ",", "namespace,namespace"} {
 		pod := map[string]string{annotationPrefix + annIPAlgo: podVal}
-		node := map[string]string{annotationPrefix + annIPAlgo: "pod"}
+		node := map[string]string{annotationPrefix + annIPAlgo: "app"}
 		got := ResolveIPAlgo(pod, node, nil)
-		want := []embed.Field{embed.FieldPod}
+		want := []embed.Field{embed.FieldApp}
 		if !equalFields(got, want) {
 			t.Fatalf("podVal=%q: got %v, want %v", podVal, got, want)
 		}
@@ -243,16 +243,16 @@ func TestResolveIPAlgo_NilNodeMap(t *testing.T) {
 }
 
 func TestResolveIPAlgo_Whitespace(t *testing.T) {
-	pod := map[string]string{annotationPrefix + annIPAlgo: " namespace , pod "}
+	pod := map[string]string{annotationPrefix + annIPAlgo: " namespace , app "}
 	got := ResolveIPAlgo(pod, nil, nil)
-	want := []embed.Field{embed.FieldNamespace, embed.FieldPod}
+	want := []embed.Field{embed.FieldNamespace, embed.FieldApp}
 	if !equalFields(got, want) {
 		t.Fatalf("got %v, want %v", got, want)
 	}
 }
 
 func TestResolveIPAlgo_DuplicateInvalidates(t *testing.T) {
-	pod := map[string]string{annotationPrefix + annIPAlgo: "pod,pod"}
+	pod := map[string]string{annotationPrefix + annIPAlgo: "app,app"}
 	node := map[string]string{annotationPrefix + annIPAlgo: "namespace"}
 	got := ResolveIPAlgo(pod, node, nil)
 	want := []embed.Field{embed.FieldNamespace}