Network resilience (4/4): registry resilience — private/mirror registry + air-gapped image bundle

[shujaatTracebloc]

Child 4/4 of #578 (network resilience).

Problem

Some sites hard-block the container registries (Docker Hub / GHCR). The images then aren't reachable directly at all.

What to build

• Support a private/mirror registry the site CAN reach (the chart already allows images.*.repository + a pull secret) — wire it end-to-end + document.
• Support an air-gapped image bundle (pre-loaded into the cluster) for fully locked-down sites.
• The installer detects a registry block and switches to / guides to the mirror or offline mode — cleanly, never a crash.

Honest limit (state it in the epic)

A site that blocks the registries and offers no reachable mirror and won't accept an offline bundle cannot be served — the software isn't reachable by definition. Everything short of that is handleable.

Acceptance

• A blocked-registry site can complete via mirror or air-gapped bundle.
• Detection + clean guidance, never a raw failure (depends on Installer must never expose tracebloc internals or user PII in logs/output #576 + PowerShell installer must never terminate ungracefully — always show the user a clean 'what happened' #577).

[shujaatTracebloc]

Completed by #604 (merged to develop as 5aedd2d).

global.imageRegistry re-homes every image the chart pulls (tracebloc/, the spawned ingestor + training-job images, and the alpine/, ubuntu/squid, busybox, curl helpers) onto a private mirror — the mechanism for both a reachable private mirror and a fully air-gapped internal registry. The installer wires it with a single knob (TRACEBLOC_IMAGE_REGISTRY, plus TRACEBLOC_REGISTRY_USERNAME/PASSWORD for an authenticated mirror). Documented in docs/INSTALL.md with a command to enumerate the exact images to mirror.

The air-gapped path is the same knob (mirror into an internal registry the cluster can reach); a standalone offline docker save/load image-tarball helper remains an optional convenience follow-up, not a blocker.