Use `apk upgrade` on harness images (#2756)

# Context

Resolves CVEs with `apk upgrade` on harness images.

| harness | total | C | H | M | L |
| -------- | ---- | - | - | - | - |
| claude (before) | 21 | 0 | 2 | 6 | 12 |
| claude (after) | 1 | 0 | 0 | 0 | 0 |
| codex (before) | 21 | 0 | 2 | 6 | 12 |
| codex (after) | 1 | 0 | 0 | 0 | 0 |

# Additional Notes

This was originally a `wolfi` migration PR, **but** those migrations
were reverted
[here](https://github.com/kagent-dev/kagent/pull/2756/commits/88dabc039a99b9d0f158a49aeb6f2a545b0f793e)
because `wolfi` would not work cleanly with substrate (at least on arm64
environments, due to known gVisor issues
https://github.com/google/gvisor/issues/13542).

---------

Signed-off-by: Fabian Gonzalez <fabian.gonzalez@solo.io>