Document registry and the Docker Hub fallback

@CptSchnitz is already working on this.

Since Sep 16, 2026.

## Parent

#17

## What to build

References that are not fully qualified start working. A bare repository alongside a registry declared elsewhere in the same document resolves against it, which is the convention most charts follow. A bare public name resolves against Docker Hub with the single-segment namespace prefix applied, so common public images verify with no setup at all.

Resolution order, when the workspace declares no registries of its own: an explicit host in the repository string, detected by the standard rule that the first path segment contains a dot or a colon or is exactly `localhost`; then a registry declared elsewhere in the same YAML document; then Docker Hub.

A registry reached only through that Docker Hub fallback is a guess, and a not-found verdict from a guess is **downgraded to unverifiable** rather than becoming a diagnostic. A positive match still renders normally, so public images keep working. This makes it structurally impossible for "we guessed the registry" and "we are confident the image is missing" to hold at the same time — which matters because a bare internal service name is the common case in this organisation's charts and it is not on Docker Hub.

Normalization belongs in the registry package rather than the Helm package: it is OCI naming semantics, not anything Helm-specific. The Helm package emits raw strings; the registry package interprets them.

## Acceptance criteria

- [ ] A bare repository with a registry declared in the same document resolves against that registry
- [ ] A fully-qualified repository still wins over a document-level registry
- [ ] Host detection follows the dot-or-colon-or-localhost rule, so a namespace segment is not mistaken for a host
- [ ] A single-segment public name gets the Docker Hub namespace prefix and verifies
- [ ] A bare name absent from Docker Hub, with no registry declared anywhere, produces no diagnostic
- [ ] That same bare name, when genuinely present on Docker Hub, still renders a checkmark
- [ ] Resolution tested through the registry package's entry point by asserting the URL the injected fetch received

## Blocked by

- #19 — Tracer bullet: conventional image references get an error diagnostic