Managed Apple Silicon hosts keep orphan-VM GC disabled through tart-kubelet updates

Fixed a configuration drift issue where managed Apple Silicon builder hosts would lose the --disable-vm-gc flag whenever tart-kubelet was updated. The flag is now preserved through binary rolls, so orphan-VM garbage collection stays disabled and in-flight image-build VMs are no longer reaped mid-build.