ci: use CI Identities for Windows internal-registry push; keep consuming from mirror

The Windows shell runners have no working registry.ddbuild.io creds (host
docker config only has the ECR cred helper, which fails with
NoCredentialProviders). Drop the dead-end AWS_REGION workaround and add the
CI Identities id_tokens to the Windows build jobs, the supported auth for
non-K8s runners (onboarding pending, #ci-identities). The assume-role +
docker-config script wiring is deferred until it can be verified post-onboarding.

Windows jobs are all manual, so they don't block the pipeline. Until internal
Windows images exist, revert the tracer/package generators to consume Windows
images from the Docker Hub mirror (ce65269 state) to avoid 404s.

Author: realFlowControl

.gitlab/generate-ci-images.php

@@ -143,17 +143,14 @@ function parse_compose(string $path, array $env): array
     - when: manual
       allow_failure: true
   needs: []
-  tags: ["windows-v2:2019"]
   timeout: 6h
+  tags: ["windows-v2:2019"]
+  id_tokens:
+    CI_IDENTITIES_GITLAB_ID_TOKEN:
+      aud: ci-identities
   variables:
     DDCI_CONFIGURE_OTEL_EXPORTER: "true"
     GIT_STRATEGY: none
-    # The host docker config uses the ecr-login credsStore; its `list` errors
-    # with MissingRegion (e.g. on the anonymous mcr.microsoft.com base pull).
-    # Give the helper a region so it stops failing; leaves the rest of the
-    # host config (and its ambient registry.ddbuild.io auth) untouched.
-    AWS_REGION: "us-east-1"
-    AWS_DEFAULT_REGION: "us-east-1"
   script: |
     # Kill leftover containers; a previous run may still hold php_ddtrace.dll open.
     $containers = docker ps -aq 2>$null

.gitlab/generate-package.php

@@ -63,7 +63,7 @@
 $windows_build_platforms = [
     [
         "triplet" => "x86_64-pc-windows-msvc",
-        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_windows",
+        "image_template" => "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-%s_windows",
         "arch" => "amd64",
         "host_os" => "windows-msvc",
         "targets" => [

.gitlab/generate-tracer.php

@@ -119,7 +119,7 @@ function before_script_steps($with_docker_auth = false) {
   variables:
     CONTAINER_NAME: $CI_JOB_NAME_SLUG
     GIT_STRATEGY: none
-    IMAGE: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_windows"
+    IMAGE: "registry.ddbuild.io/images/mirror/datadog/dd-trace-ci:php-${PHP_MAJOR_MINOR}_windows"
   script: |
 <?php windows_git_setup() ?>