fix(velero): pin AWS plugin to v1.14.2 (v1.14.3 unreleased); shrink node-agent memory req to fit workers (DEV-572)

- velero-plugin-for-aws v1.14.3 is not published on docker.io (only rc.1/rc.2). Downgrade to the latest GA tag v1.14.2 — still compatible with Velero 1.18.x.
- Drop node-agent memory request 256Mi -> 64Mi so the daemonset schedules on worker-1/2/3 (they sit at ~95% memory-request already).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/velero/values.yaml

@@ -10,7 +10,7 @@ velero:
   # the binary into /plugins so the Velero server can load it.
   initContainers:
     - name: velero-plugin-for-aws
-      image: velero/velero-plugin-for-aws:v1.14.3
+      image: velero/velero-plugin-for-aws:v1.14.2
       imagePullPolicy: IfNotPresent
       volumeMounts:
         - mountPath: /target
@@ -76,11 +76,15 @@ velero:
       cpu: 500m
       memory: 512Mi
 
+  # Small memory request so node-agent fits on the tight 4 GiB CX22 workers
+  # (worker-1/2/3 sit around 95 % memory-request already). Actual peak usage
+  # during Kopia backup lands under 300 MiB per node in practice; limit is
+  # generous so a spike does not OOM-kill mid-backup.
   nodeAgent:
     resources:
       requests:
-        cpu: 100m
-        memory: 256Mi
+        cpu: 50m
+        memory: 64Mi
       limits:
         cpu: 1000m
         memory: 1Gi