[Request]: Support for Registry Access Control (Pull/Push Permissions)

### Feature or enhancement request details

To support enterprise use of Apple’s new containerization framework, we propose a feature that allows system administrators or policy managers to control which container registries a user or process can pull from or push to. This functionality is essential for maintaining software provenance, enforcing supply chain security policies, and adhering to compliance requirements in managed environments.

**Proposed Solution:**
Introduce a configuration mechanism (e.g. a signed profile, system entitlement, or MDM-enforced policy) that supports:
• Registry Whitelisting: Define which container registries are allowed for image pulls and pushes.
• Granular Permissions: Differentiate between pull and push access for each registry.
• Wildcard and Exact Matching: Support exact hostnames (e.g. registry.corp.example.com) and optional wildcard domains (e.g. *.docker.io).
• Audit Integration: Optionally log all registry access attempts for visibility and compliance purposes.

**Use Case (Enterprise):**
An enterprise may wish to:
• Restrict developers to pulling images only from approved internal or vendor-managed registries.
• Prevent accidental or unauthorized publishing of images to public registries such as Docker Hub or GitHub Container Registry.
• Meet compliance controls related to third-party software distribution (e.g. ISO 27001, NIST, ITAR).

**Potential Impact:**
This feature would enable wider adoption of Apple’s containerization framework in regulated and security-conscious environments, such as finance, healthcare, government, and education.

**Alternatives Considered:**
• Network-layer restrictions (less precise, harder to manage on laptops)
• Pre-runtime image scanning (doesn’t prevent image usage from disallowed registries)

**Environment:**
• Platform: macOS 26
• Framework: Apple Container Runtime
• Managed: Yes (via MDM or configuration profiles)

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct