Support custom/private OCI registry for systemd-nspawn rootfs image (runtimeImage)

### Description
When deploying `aks-flex-node` in highly secure, air-gapped, or strictly regulated enterprise environments (such as banking DMZs), direct outbound connection to `ghcr.io` is forbidden by corporate firewalls.

While `aks-flex-node` allows configuration via a JSON file, the agent currently ignores any attempts to override the default OCI rootfs image location (`ghcr.io/azure/agent-ubuntu2404`) when specified inside the configuration file or via command-line flags.

### Steps to Reproduce
Configure `/etc/aks-flex-node/config.json`

Run the bootstrap command:
aks-flex-node start --config /etc/aks-flex-node/config.json

### Expected Behavior
The agent should parse the custom registry URL and pull the agent-ubuntu2404 image from the private mirror hosted on the internal network.

### Actual Behavior
The agent completely ignores the custom registry settings and falls back to hardcoded defaults, attempting a direct connection to GitHub Packages:

```
level=INFO msg="no OCI image configured, using default" image=ghcr.io/azure/agent-ubuntu2404:v20260427
level=INFO msg="pulling OCI image" image=ghcr.io/azure/agent-ubuntu2404:v20260427
level=ERROR msg=failed task=oci-download-rootfs duration=7.37ms status=failed error="pull image ghcr.io/azure/agent-ubuntu2404:v20260427: failed to perform \"FetchReference\" on source: Get \"[https://ghcr.io/v2/azure/agent-ubuntu2404/manifests/v20260427](https://ghcr.io/v2/azure/agent-ubuntu2404/manifests/v20260427)\": Forbidden"
```

### Environment
AKS Flex Node Version: v0.1.3 (Git Commit: 79c5487)

OS: Ubuntu 24.10 (Oracular Oriole)

Environment: On-premises with squid proxy and nexus proxy for docker images.

Start by reading the configuration handling for /etc/aks-flex-node/config.json and the `aks-flex-node start --config` entry point, then trace the `oci-download-rootfs` task. Verify how the runtimeImage setting is parsed and passed to the image pull. Done means a configured private registry is used instead of the ghcr.io default, with coverage for the reported behavior if existing tests provide a suitable location.

Written by the indexing model from the issue text.