Pin socktop apt version (1.60.2-1); bump to 0.3.10

Image 0.3.9 baked socktop 1.60.1 because CI's registry layer cache reused
the apt-install layer from before the 1.60.2 release. 1.60.1 has no
--no-kill flag, so the restricted shell's invocation parsed it as the
positional websocket URL, breaking (and on overwrite, corrupting) the
local profile. Pinning the package version busts the cache and ties the
installed binary to the flags the restricted shell uses.

Also point the manifest's webterm container at the current tag so a
manual kubectl apply cannot roll the image back to 0.2.2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

kubernetes/03-deployment.yaml

@@ -85,7 +85,7 @@ spec:
 
       containers:
         - name: webterm
-          image: gt.wittyoneoff.com/jason/socktop-webterm:0.2.2
+          image: gt.wittyoneoff.com/jason/socktop-webterm:0.3.10
           imagePullPolicy: Always
 
           command: ["/docker-entrypoint.sh"]