fix: update image tag default to 'latest' and improve error messages in deployment script

.gitea/workflows/nas-k3s-deploy.yml

@@ -112,7 +112,7 @@ name: Deploy NAS K3s
           - "true"
           - "false"
       image_tag:
-        description: "Docker image tag. Defaults to the pushed commit SHA first 8 chars."
+        description: "Docker image tag. Defaults to 'latest' (deploy whatever CI most recently published)."
         required: false
         default: ""
       keep_releases:
@@ -446,7 +446,7 @@ jobs:
 
           image_tag="${REQUESTED_IMAGE_TAG}"
           if [ -z "${image_tag}" ]; then
-            image_tag="$(git rev-parse --short=8 HEAD)"
+            image_tag="latest"
           fi
 
           case "${image_tag}" in
@@ -494,8 +494,8 @@ jobs:
           fi
 
           if ! bash deploy/scripts/gitea-registry-images.sh verify; then
-            echo "::error::Missing image(s) for commit ${IMAGE_TAG}. CI must publish images before CD."
-            echo "::error::Frontend images come from Frontend CI; backend/migrate images come from Backend CI."
+            echo "::error::Missing image(s) at tag '${IMAGE_TAG}' for: ${IMAGE_LIST}."
+            echo "::error::Run the matching CI workflow (Frontend CI / Backend CI) to publish images first."
             exit 1
           fi
 
@@ -640,9 +640,12 @@ jobs:
             fi
           }
 
+          # k3s installs kubeconfig at /etc/rancher/k3s/k3s.yaml with mode 0600
+          # (root only), so any kubectl path must go through sudo unless the
+          # current user is already root.
           kubectl_cmd() {
             if command -v kubectl >/dev/null 2>&1; then
-              kubectl "$@"
+              sudo_cmd kubectl "$@"
             elif command -v k3s >/dev/null 2>&1; then
               sudo_cmd k3s kubectl "$@"
             else