Separate registry access from template publishing

[czpython]

Future follow-up. The immediate Druks configuration in czpython/druks#433 works without this PR. Keep this draft separate from that deployment.

Private boot images need registry access even when no template destination is configured. Separate REGISTRY_HOST, REGISTRY_USERNAME, and REGISTRY_PASSWORD from the optional TEMPLATE_REPOSITORY path. Exe supplies credentials for boot images on that registry host, including images outside the template repository.

Template builds use the caller label in a unique build tag. Published references include the tag and digest; provisioning uses the digest and local cleanup removes the build tag. Docker and docker-sbx publish to the shared destination when configured and retain local builds when no destination is set. Template reuse still uses provider, base image, and script hash.

Druks consumer: czpython/druks#434

Deployment impact

The shared settings replace EXE_IMAGE_REGISTRY, EXE_REGISTRY_USERNAME, and EXE_REGISTRY_PASSWORD; configure the registry host and template repository path separately. No schema or SDK changes. Registry retention remains operator-owned. The docker-sbx daemon still needs its own private pull access or template import.

Verification

• uv run ruff check — passed.
• uv run ruff format --check — passed.
• uv run pyright — zero errors.
• uv run pytest -q — 538 passed.
• A temporary local registry test passed build, push, digest-pinned container startup, and tag cleanup before the final configuration split. That smoke test was not repeated after the split.
• No live GHCR or Docker Hub push, exe VM, or sandboxd private pull was tested.