feat: add regionless image resolver to envhub SDK

## Background

ROCK 沙箱在多地域部署时，容器镜像拉取体验差异大。harbor 项目中自维护了一份镜像改写逻辑（`RockRegistryResolver`），需要迁移到 ROCK 的 `rock.sdk.envhub.regionless` 模块，成为 envhub SDK 的标准能力。

## Scope

### 1. `rock.sdk.envhub.regionless.resolver`
- 从 harbor 1:1 迁移 `RockRegistryResolver` 类
- 通过 `INSTANCE_ROCK_REGISTRY` 环境变量配置 mirror registry 列表（逗号/分号分隔）
- 支持 Docker Registry v2 manifest API 探测，带 Bearer token 认证
- 进程内缓存探测结果（按 `registries|image` 键）
- digest-pinned 镜像（`@sha256:...`）不改写
- Dockerfile `FROM` 行改写（支持 `--platform`、`AS` 子句）

### 2. `rock.sdk.envhub.regionless.compose`（新增）
- `resolve_compose(compose_path)` — 遍历 compose 文件中所有 `services.*.image` 字段，逐个调用 `resolve_image` 改写
- `compose_pull(compose_path, ...)` — resolve + `docker compose pull`，resolve 失败不阻断

### 3. 测试
- 43 个单元测试覆盖：resolver（35）+ compose（8）
- 覆盖缓存去重、多 registry fallthrough、超时回退、compose rewrite、pull 失败传播等场景

## Design doc
See `docs/dev/envhub/regionless.md` on `upstream/feature/envhub`.

Start by reading the harbor implementation of RockRegistryResolver and docs/dev/envhub/regionless.md on upstream/feature/envhub. Implement the resolver in rock.sdk.envhub.regionless.resolver and compose handling in rock.sdk.envhub.regionless.compose, then run the requested 43 unit tests. Done means registry probing, caching, image and Dockerfile rewriting, compose resolution, and pull failure behavior are covered.

Written by the indexing model from the issue text.