feat: add remote repository to handle DockerHub rate limits

[dobrac]

Add Docker Hub remote repository proxy to cache Docker images and handle Docker Hub rate limits. https://docs.docker.com/docker-hub/usage/

We can add login to Docker Hub for the remote repository in a following PR.

---

Note

Adds a Docker Hub remote repository proxy (GCP/AWS/Noop) and wires it into template builds, Terraform modules, and Nomad to cache/pull public images and mitigate rate limits.

• Infra (Terraform/GCP):
  • Add remote-repository module creating google_artifact_registry_repository in remote mode with IAM and output dockerhub_remote_repository_url.
  • Wire module conditionally via var.remote_repository_enabled; add variable remote_repository_enabled and Makefile REMOTE_REPOSITORY_ENABLED tfvar.
  • Pass dockerhub_remote_repository_url into module.nomad and Nomad job env DOCKERHUB_REMOTE_REPOSITORY_URL.
• Nomad/Template Manager:
  • Extend job/template to accept and export DOCKERHUB_REMOTE_REPOSITORY_URL.
  • Add dockerhub_remote_repository_url variable and plumb through nomad/main.tf to the template-manager job.
• Orchestrator:
  • Introduce docker remote repository usage in build flow: plumb dockerhubRepository through builder, base phase, rootfs, and OCI image fetch.
  • oci.GetPublicImage now supports pulling via remote repository proxy when unauthenticated and using default registry.
  • Template server manages closers for clean shutdown.
• Shared package:
  • New packages/shared/pkg/dockerhub with providers: GCP Artifact Registry, AWS ECR, and Noop; auto-select via env and expose GetImage/Close.
• Tests:
  • Update OCI tests to use noop repository; add unit tests for tag parsing in dockerhub package.

^{Written by Cursor Bugbot for commit c7307d4. This will update automatically on new commits. Configure here.}

[linear]

ENG-2933 Handle DockerHub rate limits for general usage

[jakubno]

Lgtm, small nits