fix: pin MCP sidecar versions for stability

- Pin kubernetes-mcp to v0.0.57 (Jan 27, 2025) with token exchange and field selector support
- Pin flux-mcp to v0.41.1 (already pinned)
- Pin homeassistant-mcp to v6.7.1 (Feb 20, 2026) - latest stable release
- Update documentation with version details
- Bump chart version to 0.1.19

This ensures reproducible deployments and prevents unexpected breaking changes
from floating tags (latest/stable).

Generated with Claude Code via Happy

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

memory/MEMORY.md

@@ -14,13 +14,14 @@
 - Chart published as OCI artifact to GHCR, reconciled by Flux
 
 ## MCP Sidecars
-- **Kubernetes MCP** (port 8080): Only deployed when enabled AND `clusterAccess` != `none`
-- **Flux MCP** (port 8081): Only deployed when enabled AND `clusterAccess` != `none`
-- **Home Assistant MCP** (port 8087): Disabled by default, requires secrets:
+- **Kubernetes MCP** (v0.0.57, port 8080): Only deployed when enabled AND `clusterAccess` != `none`
+- **Flux MCP** (v0.41.1, port 8081): Only deployed when enabled AND `clusterAccess` != `none`
+- **Home Assistant MCP** (v6.7.1, port 8087): Disabled by default, requires secrets:
   - `homeassistant-url`: Base URL like `http://homeassistant.local:8123`
   - `homeassistant-token`: Long-lived access token
 - **Playwright MCP**: External service, not a sidecar
 - Configure via `mcpSidecars.<name>.enabled` in values
+- **Version Strategy**: All MCP images use pinned versions for stability (no `latest` tags)
 
 ## Common Gotchas
 - `baseimage-gui` creates user dynamically — don't hardcode usernames in scripts, use numeric UID/GID