docs: final pass before the v1.25.19 announcement

What does this MR do and why?

Final documentation pass before the v1.25.19 announcement. Every statement was checked against the released images, the pipeline, and the tree. Each fact now lives in one file and the others link to it, for about 200 fewer words overall. The warmer example is held: its cache path never reached the build job, and with that fixed, kaniko v1.25.19 pushes an invalid manifest for any OCI-typed base image.

References

• Upstream defect behind the hold: https://github.com/GoogleContainerTools/kaniko/issues/2423 and https://github.com/GoogleContainerTools/kaniko/issues/2713 ; fix PR https://github.com/GoogleContainerTools/kaniko/pull/3231 unmerged since 2024-07-02.
• Corrections in this MR: UBI_VERSION pins nothing, the UBI_*_IMAGE ARG defaults do; Renovate tracks KANIKO_VERSION and GO_VERSION through the regex manager and the UBI images through the Dockerfile manager, while GOFIPS140_VERSION is hand-maintained; the CHANGELOG is written by hand and no generator runs; the latest tags are documented; the site diagram count and the pages job copy list match the pipeline.

Variants affected

None. No Dockerfile or .gitlab-ci.yml change.

Test plan

• reference standards/security-md/check.sh against the result: 4 passed, 0 failed.
• vale over the tree: 20 errors and 55 warnings on main, 2 pre-existing RelativeLinks false positives after.
• The three examples run verbatim in a scratch project with only the tags: line removed: kaniko and kaniko-fips pass end to end. The warmer negative control archived nothing and pulled every base from the registry on a green pipeline. With the cache-dir fix, the runner archived seven files and the executor logged Found ... in local cache, then the push failed with MANIFEST_INVALID for alpine:3.24 and ubi9-minimal:9.5 and passed for ubi9/ubi:9.4, the one Docker-schema2 base found.