feat: add docker-credential-ecr-login to image

[guilhermebr]

Fixes #53.

Adds the amazon-ecr-credential-helper
(v0.12.0, current latest) to the image, mirroring the existing
docker-credential-gcr support. This enables buildkit pushes to Amazon ECR
using ambient AWS credentials (IRSA / instance profile) via the standard docker
credHelpers config:

{
  "credHelpers": {
    "123456789012.dkr.ecr.us-east-1.amazonaws.com": "ecr-login"
  }
}

Notes:

• The binary comes from the official awslabs release bucket, which publishes
  linux-amd64 and linux-arm64 paths — matching ${TARGETARCH} directly,
  so both image platforms built by CI are covered. The build runs
  docker-credential-ecr-login -v as a sanity check, like the existing
  docker-credential-gcr version call.
• Unlike the GCR block, this intentionally does not write a config.json
  at build time (gcr configure-docker has a fixed set of well-known hosts to
  register; ECR registry hosts are account/region-specific), so the
  credHelpers entry is left to the operator's mounted docker config.
• Image pruning on ECR is a separate concern (ECR has no delete-on-manifest
  API compatible with the Distribution protocol); operators typically attach an
  ECR lifecycle policy to the repository prefix.

Validated in production: deploys on an EKS cluster pushing to ECR with IRSA
credentials and the credHelpers config above — pushes authenticate with no
static secrets.