feat(oci-mirror)!: synchronize image and YAML sources

Plan

1. Sync image references, project-relative YAML files, inline YAML, and multiline image lists through Skopeo with runtime variable expansion.
2. Centralize registry authentication and migrate implicit GitHub registry access to explicit credentials, preserving deprecated Red Hat compatibility with warnings.
3. Verify source normalization, credential precedence, documentation, and the complete required MR pipeline.

Acceptance criteria

• Image, YAML file, inline YAML, and multiline sources have regression coverage; tag-and-digest sources follow the requested tag policy.
• One registry guide covers predefined GitLab credentials, authentication JSON, protected group images, and ci_registry_auth_add in before_script; consuming components link to it.
• GITHUB_TOKEN is not used implicitly for image or Helm authentication; GitHub API and Composer use remain unchanged.
• GitHub and legacy Red Hat registry settings emit credential-safe ⚠️ deprecation warnings.
• Local auth regressions, eight JSON validation tests, OCI sync regressions, nine YAML examples, Bash syntax, 22-file Markdown lint, and rendered-page review pass.
• Complete required CI succeeds for the rebased head.

Migration

target is a destination namespace prefix, not a complete image name or tag. Configure GHCR credentials explicitly through the shared registry guide. Both intentional compatibility changes are documented; no required check has been skipped or made optional.

Closes #416 (closed)

Required head validation

Implemented fully qualified images, project-relative YAML paths, inline YAML and multiline sources with runtime variable expansion and the requested tag/digest policy. Registry authentication is centralized and linked from consuming components; implicit GITHUB_TOKEN image/Helm login is removed, explicit credentials remain supported, and legacy GitHub/Red Hat settings emit credential-safe deprecation warnings. Exact-head CI passed all 39 root jobs and 60 component children. The live OCI child passed all six image/chart/file/inline jobs and destination pull/inspect checks; the source-normalization and authentication regressions also passed. Fetched, fast-forwarded and rebased without changing the validated SHA; final scoped diff reviewed. Both the source-format discussion and top-level authentication change request are addressed.