CodeArtifact/ECR: pull-through cache for public Docker

[gangster]

Part of #1249 (ADR-098, D2).

Enable ECR pull-through cache rules so public base/tooling images are lazily mirrored into our account and served with IAM auth.

Scope:

• PTC rules for docker.io, ghcr.io, quay.io, registry.k8s.io
• Docker Hub upstream credentials in Secrets Manager (avoid anonymous rate limits)
• Extend the ecr module/unit (or a sibling) as appropriate
• Confirm node/pod pull path resolves cached images; document the <acct>.dkr.ecr…/docker.io/library/... reference form

[gangster]

Done — ECR pull-through cache shipped in #1255 (fix #1261). Live rules: k8s + quay; docker.io/ghcr.io require credentials and are wired-but-gated.