refactor(BA-6632): move image scanning out of the models layer into the image repository

[fregataa]

Summary

• Move the container-registry scan/untag logic out of models/image/row.py so the models layer no longer imports the container_registry package.
• scan_single_image / rescan_images (and the registry loading/filtering helpers) now live on ImageDBSource.
• The registry untag external call lives on ImageRepository, which fetches the image + registry row first, then calls the Harbor registry directly.
• cli/image_impl uses ImageDBSource for rescan and inlines the Harbor untag.

Notes

• Pure relocation of existing logic — no new scanning behavior. The broader container-registry refactor (extracting external-access Client classes and deprecating BaseContainerRegistry) is tracked separately in BA-6634.

Test plan

• CI: pants check (mypy)
• CI: pants test — image rescan / untag paths (repository, DB source, CLI) behave unchanged

Resolves BA-6632

[Copilot]

Pull request overview

This PR is a layering refactor (BA-6632) that removes the container-registry scan/rescan/untag logic from the models layer (models/image/row.py) so that the models layer no longer imports the container_registry package. The scan/rescan orchestration and configured-registry helpers move onto ImageDBSource, the Harbor untag external call moves onto ImageRepository (fetching image + registry first, then calling Harbor outside a held DB session), and the CLI is updated to use the new locations. It's described as a pure relocation with no new scanning behavior.

Changes:

• Move rescan_images, scan_single_image, registry loading/filtering helpers, and a new fetch_image_and_registry onto ImageDBSource; remove their model-layer counterparts.
• Move untag_image_from_registry orchestration onto ImageRepository (fetch data first, then perform the Harbor v2 call without holding the DB session open).
• Update cli/image_impl.py to use ImageDBSource().rescan_images(...) and inline the Harbor v2 untag in purge_image.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/ai/backend/manager/repositories/image/repository.py	Stores _db; untag_image_from_registry now fetches image/ref/registry then calls Harbor v2 untag directly.
src/ai/backend/manager/repositories/image/db_source/db_source.py	Adds fetch_image_and_registry, scan_single_image, rescan_images, and configured-registry load/scan/filter helpers; imports get_container_registry_cls.
src/ai/backend/manager/models/image/row.py	Removes scan/rescan/untag helpers and the container_registry imports from the models layer.
src/ai/backend/manager/models/image/init.py	Drops rescan_images/scan_single_image re-exports.
src/ai/backend/manager/cli/image_impl.py	Uses ImageDBSource for rescan and inlines Harbor v2 untag in purge.
changes/12439.enhance.md	Changelog fragment describing the relocation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jopemachine]

Strictly speaking, the rescan logic would be better placed on the client side. However, I don't think it necessarily needs to be addressed in this PR.