oci-registry: the Docker config is re-read and a credential helper re-spawned for every image reference

Nobody has claimed this yet.

## Parent

#17

## Current behaviour

`checkImageExistence` resolves the credential for a registry on every call, and the extension calls it once per image reference (`apps/vscode/src/reference-check.ts` maps references through `Promise.all`). A values file naming ten images on one private registry therefore does ten `config.json` reads and ten `docker-credential-*` subprocess spawns for the same registry, each one a keychain round trip.

Nothing caches across a document's checks, and nothing caches across documents.

## Expected behaviour

Resolving a registry's credential once per registry, for as long as it is reasonable to hold it, rather than once per reference.

## Why it matters

A subprocess per reference is not just slow. On macOS a keychain helper can prompt, and `docker-credential-ecr-login` refreshes a token over the network, so the cost is real and it scales with the size of the file rather than with the number of distinct registries in it.

## Notes

Found during the two-axis review of #22. Deliberately left out of that ticket: caching is #27's subject, and the fix belongs with whatever shape that ticket settles on rather than being guessed at separately here. Filing so the finding is not lost between the two.

Worth checking against #27's design before implementing — it may fall out of that work for free.

Start by reading #27's caching design, then inspect checkImageExistence and apps/vscode/src/reference-check.ts, where references are mapped through Promise.all. Confirm the chosen cache scope and lifetime before implementing; done means repeated references for one registry reuse one credential resolution rather than rereading config.json or respawning the helper.

Written by the indexing model from the issue text.