feat(docker): support authenticated private registry image pulls

Agent Diagnostic

• Skills loaded: create-github-issue, openshell-cli, debug-openshell-cluster
• OpenShell version tested: gateway 0.0.102-dev.4, supervisor latest
• Latest release checked: unable to verify
• Known fixes reviewed: unable to verify
• Possible duplicates reviewed: searched "docker auth credentials image pull", no results
• Findings: The Docker compute driver fails to pull images from authenticated registries even when valid credentials exist in Docker's ~/.docker/config.json. Manual docker pull with the same image reference succeeds using the stored credentials. The compute driver's pull path appears to bypass Docker's credential store.
• Remaining reason for filing: The compute driver should use Docker's native credential resolution.

Description

Actual behavior: sandbox create --from <authenticated-registry>/image:tag fails with:

ImagePullFailed: pull Docker image failed: Docker responded with status code 500:
failed to resolve reference "<registry>/image:tag": pull access denied,
repository does not exist or may require authorization: authorization failed:
no basic auth credentials

Meanwhile, running docker pull <registry>/image:tag directly on the same host succeeds because Docker reads credentials from ~/.docker/config.json.

Expected behavior: The Docker compute driver should use the Docker daemon's configured credential store when pulling images. If Docker is authenticated to a registry (via docker login or config.json), sandbox creation should inherit those credentials for image pulls.

Reproduction Steps

1. Authenticate Docker to a private registry: docker login <registry>
2. Verify manual pull works: docker pull <registry>/image:tag (succeeds)
3. Create a sandbox with the same image: openshell sandbox create --name test --from <registry>/image:tag --no-tty -- echo ready
4. Observe ImagePullFailed with "no basic auth credentials"

This is not registry-specific. Observed with OpenShift's internal image registry, but the same behavior would occur with any authenticated registry (quay.io, ghcr.io, etc.) where credentials are stored in Docker's config but not passed through the compute driver's pull API call.

Environment

• OpenShell gateway: 0.0.102-dev.4
• Compute driver: Docker (CE)
• Docker version: standard Fedora 44 package
• Registry: OpenShift internal image registry (authenticated via token)

Start by reproducing the failure through the Docker compute driver's image-pull path after authenticating with docker login, then compare it with a direct docker pull using the same image. Done means sandbox create succeeds for an authenticated private-registry image by using Docker's configured credential store.