[miki3421]

The 0.9.0 runtime-preloader integration test assumes that every configured image starts with apache/. The shipped catalog also contains openwhisk/ images, so valid preloader output fails the test in the original 0.9.0 CI run 38893750250.

Compare the complete multiset of preloader container names and images against the configured default runtimes and always-preloaded :sys runtimes, across registries. This retains checks for missing runtimes, wrong images/tags, wrong identities and duplicates. Runtime-selection code and the runtime catalog are unchanged.

Validation:

• 7 focused regression tests and all 21 shared regression tests passed locally. The mixed-registry fixture fails against the old integration assertion and passes with the corrected test.
• The regression tests execute the actual integration script with Kubernetes I/O mocked, including a non-default :sys runtime, and deliberately corrupt or remove parser output to verify rejection.
• CI runs the regression suite and rejects integration failures. The two known baseline failures are tolerated only while the corresponding test script matches its original 0.9.0 Git blob exactly. This PR changes its integration script, so its test must pass despite the legacy task itest runner's exit-code behavior. The workflow change is identical in both independent PRs; after both scripts are updated, neither failure can be downgraded to a warning.

This PR is independent of the FerretDB correction and of the Redis/etcd/Milvus security backports. Current-head CI: Check run 39296649683 passed on 1b0888a: all 21 regression tests, the unit-test step and the final integration gate passed. tests/kind/runtimes_preloader_test.ipy reports OK. The only remaining warning is the unchanged original tests/kind/ferretdb_test.ipy test, addressed by the separate companion PR. The two patches were also combined locally: all 29 regression tests passed, and the shared CI gate passed 9 scenarios, including rejection of either failed corrected test after both fixes are present.