[master] docs: clarify OCI Connector pull secret requirements

[tossmilestone]

Summary

Cherry-pick the docs-only OCI Connector pull Secret clarification from the merged release-4.4 delivery into master for ACP-54758.

Source delivery: #981

Changes

• Clarify that an OCI Connector workload still requires a Connector proxy image pull Secret.
• Document Pod imagePullSecrets and ServiceAccount inheritance as alternative sources.
• Document proxy server, authorized ServiceAccount token, namespace, Secret type, token lifetime, and troubleshooting order.
• Apply the same contract to Deployment, StatefulSet, DaemonSet, CronJob, and Image Application documentation.
• Keep the documentation Connector-version-neutral.
• Preserve existing private registry and platform Integration credential behavior.

Scope

• Target branch: master
• Changed files: six approved MDX files only
• Component image: N/A — docs-only change
• Connector runtime E2E: SKIPPED — user-approved out of scope

Verification

• yarn lint: PASS, 0 errors and 0 warnings
• yarn build: PASS
• Static scope and version-neutral checks: PASS
• Independent cherry-pick review: no Critical, Important, or Minor findings
• Cherry-pick provenance: source merge commit 565ca97fccc9ee09511e09ed43b289a9549e12b8

Rollback

Revert the resulting squash merge commit on master through a standard pull request.

[tossmilestone]

ACP-54758 Test Cases

Status: Test plan for the master documentation backport. Connector runtime functionality is not part of the approved verification scope.

TC-1 — Cherry-pick scope

Given the ACP-54758 pull request targets master,
When the cumulative diff is reviewed,
Then only the six approved MDX files are changed and their content matches the resolved docs fix.

TC-2 — Connector-version-neutral documentation

Given the six changed pages,
When their source and rendered output are inspected,
Then no concrete Connector version, versioned Connector URL, guessed latest URL, or obsolete third-party-image-only Pull Secret restriction remains.

TC-3 — Unified image pull Secret contract

Given the common ImagePullSecret guide and the five workload entry pages,
When the documentation is read,
Then it describes the Connector proxy server, an authorized ServiceAccount token, the workload namespace, kubernetes.io/dockerconfigjson, Pod direct reference or ServiceAccount inheritance, token lifetime, and the troubleshooting sequence.

TC-4 — Entry consistency

Given Deployment, StatefulSet, DaemonSet, CronJob, and Image Application documentation,
When each create/update path is reviewed,
Then every entry links to the same internal OCI Connector ImagePullSecret guide and preserves its workload-specific update guidance.

TC-5 — Non-Connector regression

Given a private registry image or a platform Integration image that does not use an OCI Connector,
When the credential documentation is reviewed,
Then the existing registry or Integration credential behavior remains unchanged and is not replaced by a Connector proxy Secret requirement.

TC-6 — Documentation verification

Given the PR head revision,
When repository lint, build, preview, and CI checks run,
Then they complete successfully without MDX parsing, link, or rendering failures.

Scope exclusion

Connector runtime E2E, including admission annotation handling, image rewriting, Pod state, and Events, is SKIPPED — user-approved out of scope. This documentation verification does not claim that Connector runtime functionality was tested.

[cloudflare-workers-and-pages]

Deploying alauda-container-platform with    Cloudflare Pages

Latest commit:	03e27b5
Status:	✅  Deploy successful!
Preview URL:	https://812ab517.alauda-container-platform.pages.dev
Branch Preview URL:	https://acp-54758-oci-connector-pull.alauda-container-platform.pages.dev

View logs