Separate registry push and pull endpoints

[miki3421]

What changed

• distinguish the registry endpoint used by BuildKit pods from the endpoint used by node runtimes
• reconcile separate pull and push Docker config Secrets
• annotate the cluster config with explicit and backward-compatible registry metadata
• support an explicit K3s node-reachable registry hostname and derive it when needed
• restrict system API Secret access to the two registry Secrets
• disable the registry 3 OpenTelemetry exporter when no collector is configured

Why

A Kubernetes Service is reachable from a BuildKit pod but is not resolvable by containerd on a node. Reusing one hostname for both directions causes generated action images to work on Kind only by accident and fail on K3s.

Impact

BuildKit pushes through nuvolaris-registry-svc:5000; action image references use the node-reachable endpoint. Existing registry_host and registry_internal_host annotations remain populated for compatibility.

This draft is coordinated with changes in openserverless-task, openserverless-admin-api, openserverless-runtimes, and openserverless-testing.

Validation

• 3 endpoint-resolution unit tests covering Kind, configured K3s, and derived K3s hosts
• YAML parsing and git diff --check
• Secret auth keys and restricted RBAC verified on Kind and K3s
• runtime image push/pull and action invocation verified on both clusters
• registry tracing errors verified absent after rollout