chore(ci): scenario tests pick docker registry by repo on v5-next (#24022)

## What

In `ci3.yml`'s `ci-network-scenario` job, select the Aztec docker image
registry based on the repository for release-tag runs, instead of
hardcoding `aztecprotocol/aztec:${tag}`:

- `AztecProtocol/aztec-packages-private` → `INTERNAL_DOCKER_REGISTRY`
(masked)
- everything else → `aztecprotocol` (public)

Also wires `INTERNAL_DOCKER_REGISTRY` into the step env.

## Why

The nightly Spartan scenario tests run on the **private** repo from
`v5.*` nightly tags (cut from `v5-next`), so the executing `ci3.yml` is
the one on `v5-next`. There it still pulled `aztecprotocol/aztec:${tag}`
from the public registry, which does not hold the private/internal
image.

This is the same public/private split already used for
`deploy-staging-internal` vs `deploy-staging-public`
(`use_internal_docker_registry`), and is a backport of the equivalent
change already on `next` (commit `01f1bc5e9a8`, "chore: deployments",
A-1163) that was not carried over to `v5-next`.

---
*Created by
[claudebox](https://claudebox.work/v2/sessions/e39ae8121349e17d) ·
group: `slackbot`*

Author: alexghr

.github/workflows/ci3.yml

@@ -254,6 +254,7 @@ jobs:
           DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          INTERNAL_DOCKER_REGISTRY: ${{ secrets.INTERNAL_DOCKER_REGISTRY }}
           CI3_INSTANCE_PROFILE_NAME: ${{ secrets.CI3_INSTANCE_PROFILE_NAME }}
           CI3_SECURITY_GROUP_ID: ${{ secrets.CI3_SECURITY_GROUP_ID }}
           RUN_ID: ${{ github.run_id }}
@@ -269,7 +270,16 @@ jobs:
             tag="${tag#v}"
             major_version=$(./ci3/semver major "$tag")
             namespace="v${major_version}-scenario"
-            docker_image="aztecprotocol/aztec:${tag}"
+            case "$GITHUB_REPOSITORY" in
+              AztecProtocol/aztec-packages-private)
+                image_registry="${INTERNAL_DOCKER_REGISTRY%/}"
+                echo "::add-mask::${image_registry}"
+                ;;
+              *)
+                image_registry="aztecprotocol"
+                ;;
+            esac
+            docker_image="${image_registry}/aztec:${tag}"
           else
             # branch name
             namespace=pr-$(echo "$HEAD_REF" | sed 's/[^a-z0-9-]/-/g' | cut -c1-20 | sed 's/-*$//')