Part of #1486. Depends on the centralization issue.

Flip pkg/header.Domain to aicr.run and regenerate all non-signed artifacts in the same commit so CI stays green.

Covers:

• Artifact apiVersion group (aicr.run/v1alpha1, aicr.run/v1beta1) — version segments unchanged
• K8s label keys (pkg/validator/labels) and annotation keys (bundler, validate)
• OpenAPI contract api/aicr/v1/server.yaml
• YAML fixtures / e2e / chainsaw test data

Acceptance criteria

• Domain = "aicr.run"; version segments untouched
• OpenAPI + fixtures regenerated and consistent
• make qualify green