Epic: package registry — AWS CodeArtifact (+ ECR pull-through cache) — implement ADR-098

[gangster]

Implement the package-registry decision recorded in ADR-098 (docs/adrs/098-package-registry-codeartifact.md, PR #1248).

Goal

Give the platform a first-class language-package registry (the sibling to ECR for OCI), plus a public-Docker mirror, without a self-hosted registry — reusing the existing IAM / Pod-Identity / GitHub-OIDC auth model.

Shape (from ADR-098)

• CodeArtifact — one domain in the platform account, cross-account read, per-Team/Product repos, upstream connections proxying+caching public repos (npmjs / PyPI / Maven Central / NuGet / …).
• ECR pull-through cache for docker.io / ghcr.io / quay.io / registry.k8s.io — closes the Docker-mirror gap natively (no new tool).
• Auth reuses the model — Pod Identity (runtime read) + GitHub OIDC (CI publish); no local users, no SSO surface.
• Derive per-Product scoping from the Product registry (ADR-069), consistent with ecr/policy/github-oidc.

Workstreams

• CodeArtifact: codeartifact Terraform module #1250 — codeartifact Terraform module (domain, KMS, repos, upstream connections, cross-account domain policy)
• CodeArtifact: live unit + per-Product derivation #1251 — CodeArtifact live unit + per-Product derivation from the Product registry
• CodeArtifact/ECR: pull-through cache for public Docker #1252 — ECR pull-through cache rules + Secrets Manager upstream credentials
• CodeArtifact: consumer + CI auth wiring #1253 — consumer + CI auth wiring (Pod Identity read, GitHub OIDC publish)
• CodeArtifact: client bootstrap (scaffolder + docs) #1254 — client bootstrap (scaffolder + docs)

Deferred (ADR-098 D5)

• Go modules — CodeArtifact doesn't serve them. Follow-up spike: Athens GOPROXY vs. accepting direct GOPROXY (already used for crank). Not in this epic's scope.

Decision record: ADR-098. Sibling: ADR-028 (ECR).